deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0217
Published: 2006-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 3.67 allow remote attackers to inject arbitrary web script or HTML via the (1) item parameter in item.pl and (2) category parameter in itemlist.pl, which reflects the XSS in an error message. NOTE: the affected version might be wrong since the current version as of 20060116 is 3.6.1.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0517.html; http://secunia.com/advisories/18477; http://www.osvdb.org/22443
CVE: CVE-2006-0218
Published: 2006-01-16
Description: Multiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0.2 have unspecified impact and attack vectors, related to (1) admin/moderate.php, (2) admin/themes.php, (3) inc/functions.php, (4) inc/functions_upload.php, (5) printthread.php, and (6) usercp.php, and probably related to SQL injection.  NOTE: it is likely that this issue subsumes CVE-2005-4602 and CVE-2005-4603.  However, since the vendor advisory is vague and additional files are mentioned, is is likely that this contains at least one distinct vulnerability from CVE-2005-4602 and CVE-2005-4603.
CVSS Score: 10.0 (HIGH)
References: http://community.mybboard.net/showthread.php?tid=5852; http://community.mybboard.net/showthread.php?tid=5852
CVE: CVE-2006-0219
Published: 2006-01-16
Description: The original distribution of MyBulletinBoard (MyBB) to update from older versions to 1.0.2 omits or includes older versions of certain critical files, which allows attackers to conduct (1) SQL injection attacks via an attachment name that is not properly handled by inc/functions_upload.php (CVE-2005-4602), and possibly (2) other attacks related to threadmode in usercp.php.
CVSS Score: 7.5 (HIGH)
References: http://community.mybboard.net/showthread.php?tid=5853&pid=35088#pid35088; http://community.mybboard.net/showthread.php?tid=5853&pid=35151#pid35151; http://community.mybboard.net/showthread.php?tid=5960
CVE: CVE-2006-0220
Published: 2006-01-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3 through 6.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the day parameter in calendar.php and (2) the input form in search.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  It is possible that this issue is resultant from an SQL injection problem in CVE-2005-4227.3 and CVE-2005-4227.13.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/421914/100/0/threaded; http://www.securityfocus.com/bid/16232; https://exchange.xforce.ibmcloud.com/vulnerabilities/24153
CVE: CVE-2006-0221
Published: 2006-01-16
Description: SQL injection vulnerability in index.asp in the Admin Panel in Dragon Design Services Network (DDSN) cm3 content manager (CM3CMS) allows remote attackers to execute arbitrary SQL commands via the (1) username or (2) password.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/22696; http://www.securityfocus.com/archive/1/421941/100/0/threaded; http://www.securityfocus.com/bid/16231
CVE: CVE-2006-0222
Published: 2006-01-16
Description: Cross-site scripting (XSS) vulnerability in fullview.php in AlstraSoft Template Seller Pro allows remote attackers to inject arbitrary web script or HTML via the tempid parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://www.osvdb.org/22746; http://www.securityfocus.com/archive/1/421916/100/0/threaded; http://www.securityfocus.com/bid/16233
CVE: CVE-2006-0223
Published: 2006-01-16
Description: Directory traversal vulnerability in Shanghai TopCMM 123 Flash Chat Server Software 5.1 allows attackers to create or overwrite arbitrary files on the server via ".." (dot dot) sequences in the username field.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/18455; http://www.123flashchat.com/flash-chat-server-v512.html; http://www.osvdb.org/22440
CVE: CVE-2006-0227
Published: 2006-01-17
Description: Multiple unspecified vulnerabilities in lpsched in Sun Solaris 8, 9, and 10 allow local users to delete arbitrary files or disable the LP print service via unknown attack vectors.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/18498; http://secunia.com/advisories/19087; http://securitytracker.com/id?1015492
CVE: CVE-2006-0228
Published: 2006-01-17
Description: The RBAC functionality in grsecurity before 2.1.8 does not properly handle when the admin role creates a service and then exits the shell without unauthenticating, which causes the service to be restarted with the admin role still active.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/18458; http://www.grsecurity.org/news.php#grsec218; http://www.securityfocus.com/bid/16261
CVE: CVE-2006-0229
Published: 2006-01-17
Description: Unquoted Windows search path vulnerability in Wehntrust might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when Wehntrust creates the autostart key.
CVSS Score: 2.1 (LOW)
References: http://www.securityfocus.com/archive/1/422020/100/0/threaded; http://www.securityfocus.com/archive/1/422046/100/0/threaded; http://www.securityfocus.com/bid/16268
CVE: CVE-2006-0233
Published: 2006-01-18
Description: Cross-site scripting (XSS) vulnerability in functions.php in microBlog 2.0 RC-10 allows remote attackers to inject arbitrary web script and HTML via a javascript: URI in a [url] BBcode tag.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://evuln.com/vulns/36/summary.html; http://securitytracker.com/id?1015496; http://www.securityfocus.com/archive/1/422145/100/0/threaded
CVE: CVE-2006-0234
Published: 2006-01-18
Description: SQL injection vulnerability in index.php in microBlog 2.0 RC-10 allows remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/35/summary.html; http://secunia.com/advisories/18442; http://securitytracker.com/id?1015496
CVE: CVE-2006-0235
Published: 2006-01-18
Description: SQL injection vulnerability in WhiteAlbum 2.5 allows remote attackers to execute arbitrary SQL commands via the dir parameter to pictures.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18460; http://www.biyosecurity.be/bugs/whitealbum.txt; http://www.osvdb.org/22520
CVE: CVE-2006-0236
Published: 2006-01-18
Description: GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-assisted attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an inconsistent Content-Type header, which could be used to trick a user into downloading dangerous content by dragging or saving the attachment.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/15907; http://secunia.com/secunia_research/2005-22/advisory; http://www.mandriva.com/security/advisories?name=MDKSA-2006:021
CVE: CVE-2006-0237
Published: 2006-01-18
Description: Cross-site scripting (XSS) vulnerability in index.php in GTP iCommerce allows remote attackers to inject arbitrary web script or HTML via the (1) cat and (2) subcat parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18470; http://www.securityfocus.com/bid/16255; http://www.vupen.com/english/advisories/2006/0214
CVE: CVE-2006-0238
Published: 2006-01-18
Description: SQL injection vulnerability in wp-stats.php in GaMerZ WP-Stats 2.0 allows remote attackers to execute arbitrary SQL commands via the author parameter.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/ref/22/22450-wpstats.txt; http://secunia.com/advisories/18471; http://www.lesterchan.net/blogs/
CVE: CVE-2006-0239
Published: 2006-01-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Simple Blog 2.1 allow remote attackers to inject arbitrary web script or HTML via (1) a comment to comments.asp and (2) possibly certain other fields in unspecified scripts.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/18488; http://www.hackerscenter.com/archive/view.asp?id=21926; http://www.osvdb.org/22448
CVE: CVE-2006-0240
Published: 2006-01-18
Description: Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/18488; http://www.hackerscenter.com/archive/view.asp?id=21926; http://www.osvdb.org/22447
CVE: CVE-2006-0241
Published: 2006-01-18
Description: Cross-site scripting vulnerability in WBNews 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the Name field.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18499; http://www.securityfocus.com/archive/1/422133/100/0/threaded; http://www.securityfocus.com/bid/16277
CVE: CVE-2006-0242
Published: 2006-01-18
Description: Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://securityreason.com/securityalert/355; http://www.securityfocus.com/archive/1/422124/100/0/threaded; http://www.securityfocus.com/bid/16274
CVE: CVE-2006-0044
Published: 2006-01-18
Description: Unspecified vulnerability in context.py in Albatross web application toolkit before 1.33 allows remote attackers to execute arbitrary commands via unspecified vectors involving template files and the "handling of submitted form fields".
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18457; http://secunia.com/advisories/18496; http://security.debian.org/pool/updates/main/a/albatross/albatross_1.20-2.diff.gz
CVE: CVE-2006-0243
Published: 2006-01-18
Description: Cross-site scripting (XSS) vulnerability in SMBCMS 2.1 allows remote attackers to inject arbitrary web script or HTML via the text parameter, which is used by the "Search Site" field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18454; http://www.osvdb.org/22494; http://www.securityfocus.com/bid/16281
CVE: CVE-2006-0244
Published: 2006-01-18
Description: Directory traversal vulnerability in workspaces.php in phpXplorer 0.9.33 allows remote attackers to include arbitrary files via a .. (dot dot) and trailing null byte (%00) in the sShare parameter.  NOTE: a followup post claims that this is not a vulnerability since the functionality of phpXplorer supports the upload of PHP files, which would not cross privilege boundaries since the PHP functionality would support read access outside the web root
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18518; http://securityreason.com/securityalert/353; http://www.arrelnet.com/advisories/adv20060116.html
CVE: CVE-2006-0245
Published: 2006-01-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.7-pl1 allow remote attackers to inject arbitrary web script or HTML via the (3) redir, (4) productId, (5) docId, (6) act, and (7) catId parameters in index.php; and the (8) username field in a login action in index.php.  NOTE: the cart.php/redir and index.php/searchStr vectors are already covered by CVE-2005-3152.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.cubecart.com/?do=details&id=459; http://lostmon.blogspot.com/2006/01/cubecart-307-pl1-indexphp-multiple.html; http://secunia.com/advisories/18519
CVE: CVE-2006-0246
Published: 2006-01-18
Description: Cross-site scripting (XSS) vulnerability in down.pl in Widexl Download Tracker 1.06 allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/22/22462-widexl.txt; http://secunia.com/advisories/18472; http://www.osvdb.org/22462
CVE: CVE-2006-0247
Published: 2006-01-18
Description: Cross-site scripting (XSS) vulnerability in anyboard.cgi in Netbula Anyboard 9.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tK parameter in a find command.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/22/22461-anyboard.txt; http://secunia.com/advisories/18469; http://www.osvdb.org/22461
CVE: CVE-2006-0248
Published: 2006-01-18
Description: Virata-EmWeb web server 6_1_0, as used in (1) Intracom JetSpeed 500 and 520 and (2) Allied Data Technologies CopperJet 811 RouterPlus, allows remote attackers to access privileged information, such as user lists and configuration settings, via direct HTTP requests.
CVSS Score: 5.0 (MEDIUM)
References: http://blog.globalnetworks.gr/?p=4; http://secunia.com/advisories/18483; http://www.vupen.com/english/advisories/2006/0218
CVE: CVE-2006-0249
Published: 2006-01-18
Description: SQL injection vulnerability in viewcat.php in BitDamaged geoBlog MOD_1.0 allows remote attackers to execute arbitrary SQL commands, then steal credentials and upload files, via the cat parameter ($tmpCategory variable).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://evuln.com/vulns/33/summary.html; http://secunia.com/advisories/18504; http://securitytracker.com/id?1015493
CVE: CVE-2006-0250
Published: 2006-01-18
Description: Format string vulnerability in the snmp_input function in snmptrapd in CMU SNMP utilities (cmu-snmp) allows remote attackers to execute arbitrary code by sending crafted SNMP messages to UDP port 162.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/18525; http://www.digitalarmaments.com/[PII_REDACTED].html; http://www.osvdb.org/22493
CVE: CVE-2006-0251
Published: 2006-01-18
Description: Cross-site scripting (XSS) vulnerability in fom.cgi in Faq-O-Matic 2.711 allows remote attackers to inject arbitrary web script or HTML via the (1) _duration, (2) file, and (3) cmd parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/22/22439-faqomatic.txt; http://secunia.com/advisories/18468; http://www.osvdb.org/22439
CVE: CVE-2006-0252
Published: 2006-01-18
Description: SQL injection vulnerability in Benders Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via multiple parameters, as demonstrated by the (1) year, (2) month, and (3) day parameters.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/30/summary.html; http://secunia.com/advisories/18462; http://securitytracker.com/id?1015491
CVE: CVE-2006-0253
Published: 2006-01-18
Description: Buffer overflow in the Bluetooth OBEX Object Push service in "Blue Neighbors.EXE" in AmbiCom Blue Neighbors 2.50 Build 2500 and earlier allows remote attackers to execute arbitrary code via a long file name, as demonstrated via a long RFILE argument to ussp-push.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/18466; http://securityreason.com/securityalert/366; http://www.digitalmunition.com/DMA%5B2006-0115a%5D.txt
CVE: CVE-2006-0254
Published: 2006-01-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
CVSS Score: 4.3 (MEDIUM)
References: http://issues.apache.org/jira/browse/GERONIMO-1474; http://rhn.redhat.com/errata/RHSA-2008-0630.html; http://secunia.com/advisories/18485
CVE: CVE-2006-0255
Published: 2006-01-18
Description: Unquoted Windows search path vulnerability in Check Point VPN-1 SecureClient might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run when SecureClient attempts to launch the Sr_GUI.exe program.
CVSS Score: 7.2 (HIGH)
References: http://secdev.zoller.lu/research/checkpoint.txt; http://www.securityfocus.com/archive/1/422263/100/0/threaded; http://www.securityfocus.com/bid/16290
CVE: CVE-2006-0256
Published: 2006-01-18
Description: Unspecified vulnerability in the Advanced Queuing component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.6, 10.1.0.3 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB01.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0257
Published: 2006-01-18
Description: Unspecified vulnerability in the Change Data Capture component of Oracle Database server 9.2.0.7, 10.1.0.5, and 10.2.0.1 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB02.  NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that the problem is SQL injection in the CDC_ALLOCATE_LOCK function of the DBMS_CDC_UTILITY package.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0258
Published: 2006-01-18
Description: Unspecified vulnerability in the Connection Manager component of Oracle Database server 8.1.7.4 and 9.0.1.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB03.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0259
Published: 2006-01-18
Description: Multiple unspecified vulnerabilities in Oracle Database server 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB04 and (2) DB06 in the (a) Data Pump component; (3) DB10 in the (b) Net Listener component; and (4) DB16 in the (c) Oracle Text component.  NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB06 is SQL injection in the GENERATE_JOB_NAME, GET_WORKERSTATUSLIST1010, GET_PARAMVALUES1010, GET_DUMPFILESET1010, GET_JOBSTATUS1010, ATTACH, and ESTABLISH_REMOTE_CONTEXT functions in DBMS_DATAPUMP.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0260
Published: 2006-01-18
Description: Multiple unspecified vulnerabilities in Oracle Database server 9.2.0.7 and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB05 in the (a) Data Pump component; (2) DB15 in the (b) Oracle Text component; (3) DB22 in the (c) Streams Apply component; (4) DB23 and (5) DB24 in the (d) Streams Capture component; and (6) DB26 in the (e) Streams Subcomponent.  NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB05 involves SQL injection in the (f) LONG2VARCHAR, LONG2VCMAX, LONG2VCNT, and LONG2CLOB functions in the DBMS_METADATA_UTIL package; (g) MAKE_FILTER, FETCH_VIEWS_ERROR, FETCH_FILTERS, FETCH_VIEWS, SET_FILTER_COMMON, DO_FILTER_SCRIPT, SET_TABLE_FILTERS, and MAKE_FILTER_TEXT functions in the DBMS_METADATA_INT package; and (h) GET_PREPOST_TABLE_ACT function in the DBMS_METADATA package.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0261
Published: 2006-01-18
Description: Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.5 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB07 in the Dictionary component and (2) DB14 in the Oracle Label Security component.  NOTE: Oracle has not disputed reliable researcher claims that DB07 involves plaintext storage of the TDE wallet password in a trace file by event 10053.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0262
Published: 2006-01-18
Description: Unspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB08.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0263
Published: 2006-01-18
Description: Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB09 in the (a) Net Listener component; and (2) DB12 and (3) DB13 in the Network Communications (RPC) component.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0264
Published: 2006-01-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-0259.  Reason: This candidate is subsumed by CVE-2006-0259.  An error during initial CVE analysis used the wrong set of affected versions for "DB10". Notes: All CVE users should reference CVE-2006-0259 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-0265
Published: 2006-01-18
Description: Multiple unspecified vulnerabilities in Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.1 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) DB17 in the Oracle Text component and (2) DB18 in the Program Interface Network component.  NOTE: details are unavailable from Oracle, but they have not publicly disputed a claim by a reliable independent researcher that states that DB17 involves SQL injection in the (a) VALIDATE_STATEMENT and BUILD_DML functions in CTXSYS.DRILOAD; (b) CLEAN_DML function in CTXSYS.DRIDML; (c) GET_ROWID function in CTXSYS.CTX_DOC; (d) BROWSE_WORDS function in CTXSYS.CTX_QUERY; and (e) ODCIINDEXTRUNCATE, ODCIINDEXDROP, and ODCIINDEXDELETE functions in CATINDEXMETHODS.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0266
Published: 2006-01-18
Description: Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB19.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0267
Published: 2006-01-18
Description: Unspecified vulnerability in the Query Optimizer component of Oracle Database server 9.2.0.6 and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB20.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499
CVE: CVE-2006-0268
Published: 2006-01-18
Description: Unspecified vulnerability in the Security component of Oracle Database server 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has unspecified impact and attack vectors, as identified by Oracle Vuln# DB21.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/18493; http://secunia.com/advisories/18608; http://securitytracker.com/id?1015499