deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3661
Published: 2006-07-18
Description: Cross-site scripting (XSS) vulnerability in Index.PHP in CuteNews 1.4.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 2.6 (LOW)
References: http://www.securityfocus.com/bid/18918; http://www.virangar.org; http://www.securityfocus.com/bid/18918
CVE: CVE-2006-3662
Published: 2006-07-18
Description: SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible."  However, the relevant source code suggests that this issue may be legitimate, and the parameter is cleansed in 1.5.3.1
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0096.html; http://www.osvdb.org/28188; http://www.securityfocus.com/archive/1/439873/100/100/threaded
CVE: CVE-2006-3663
Published: 2006-07-18
Description: Finjan Vital Security Appliance 5100/8100 NG 8.3.5 stores passwords in plaintext in a backup file, which allows local users to gain privileges.  NOTE: the vendor has notified CVE that this issue was fixed in 8.3.6.
CVSS Score: 4.6 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047797.html; http://www.securityfocus.com/archive/1/440128/100/0/threaded; http://www.securityfocus.com/bid/18940
CVE: CVE-2006-3664
Published: 2006-07-18
Description: Unspecified vulnerability in NIS server on Sun Solaris 8, 9, and 10 allows local and remote attackers to cause a denial of service (ypserv hang) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21047; http://securitytracker.com/id?1016494; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102462-1
CVE: CVE-2006-3665
Published: 2006-07-18
Description: SquirrelMail 1.4.6 and earlier, with register_globals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors.  NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/17005; http://www.squirrelmail.org/changelog.php; http://www.vupen.com/english/advisories/2006/2708
CVE: CVE-2006-3666
Published: 2006-07-18
Description: SQL injection vulnerability in AjaxPortal 3.0, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the 'Search' field, a different vulnerability than CVE-2006-3515.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20985; http://www.osvdb.org/27068; http://www.securityfocus.com/archive/1/439614
CVE: CVE-2006-3667
Published: 2006-07-18
Description: Unspecified vulnerability in Sybase/Financial Fusion Consumer Banking Suite versions before 20060706 has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21004; http://securitytracker.com/id?1016533; http://www.securityfocus.com/bid/19076
CVE: CVE-2006-3668
Published: 2006-07-18
Description: Heap-based buffer overflow in the it_read_envelope function in Dynamic Universal Music Bibliotheque (DUMB) 0.9.3 and earlier and current CVS as of 20060716, including libdumb, allows user-assisted attackers to execute arbitrary code via a ".it" (Impulse Tracker) file with an envelope with a large number of nodes.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/dumbit-adv.txt; http://secunia.com/advisories/21092; http://secunia.com/advisories/21184
CVE: CVE-2006-3669
Published: 2006-07-18
Description: Mercury Messenger, possibly 1.7.1.1 and other versions, when running on a multi-user Mac OS X platform, stores chat logs with world-readable permissions within the /Users directory, which allows local users to read the chat logs from other users.
CVSS Score: 2.1 (LOW)
References: http://www.securityfocus.com/archive/1/440243/100/0/threaded; http://www.securityfocus.com/bid/19005; https://exchange.xforce.ibmcloud.com/vulnerabilities/27767
CVE: CVE-2006-3670
Published: 2006-07-18
Description: Stack-based buffer overflow in Winlpd 1.26 allows remote attackers to execute arbitrary code via a long string in a request to TCP port 515.
CVSS Score: 7.5 (HIGH)
References: http://foro.elhacker.net/index.php/topic%2C131756.htm; http://secunia.com/advisories/21058; http://securitytracker.com/id?1016510
CVE: CVE-2006-3671
Published: 2006-07-18
Description: Cross-site request forgery (CSRF) vulnerability in the communicate function in estmaster.c for Hyper Estraier before 1.3.3 allows remote attackers to perform unauthorized actions as other users via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21049; http://sourceforge.net/project/shownotes.php?release_id=432119; http://www.vupen.com/english/advisories/2006/2827
CVE: CVE-2006-3672
Published: 2006-07-18
Description: KDE Konqueror 3.5.1 and earlier allows remote attackers to cause a denial of service (application crash) by calling the replaceChild method on a DOM object, which triggers a null dereference, as demonstrated by calling document.replaceChild with a 0 (zero) argument.
CVSS Score: 2.6 (LOW)
References: http://browserfun.blogspot.com/2006/07/mobb-14-konqueror-replacechild.html; http://www.mandriva.com/security/advisories?name=MDKSA-2006:130; http://www.osvdb.org/27058
CVE: CVE-2006-3673
Published: 2006-07-18
Description: nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (application crash) via a large owner value, which causes an assert error.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/atrondos-adv.txt; http://secunia.com/advisories/21093; http://securityreason.com/securityalert/1239
CVE: CVE-2006-3674
Published: 2006-07-18
Description: nNetObject.cpp in Armagetron Advanced 2.8.2 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a large number handled by the id_req_handler function.
CVSS Score: 7.8 (HIGH)
References: http://aluigi.altervista.org/adv/atrondos-adv.txt; http://secunia.com/advisories/21093; http://securityreason.com/securityalert/1239
CVE: CVE-2006-0817
Published: 2006-07-21
Description: Absolute path directory traversal vulnerability in (a) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (b) VisNetic MailServer before 8.5.0.5 allows remote attackers to include arbitrary files via a full Windows path and drive letter in the (1) language parameter in accounts/inc/include.php and (2) lang_settings parameter in admin/inc/include.php, which is not properly sanitized by the securepath function, a related issue to CVE-2005-4556.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18953; http://secunia.com/advisories/18966; http://secunia.com/secunia_research/2006-12/advisory/
CVE: CVE-2006-0818
Published: 2006-07-21
Description: Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the lang_settings parameter to mail/index.html, which is not properly sanitized by the validatefolder PHP function, possibly due to an incomplete fix for CVE-2005-4558.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/18953; http://secunia.com/advisories/18966; http://secunia.com/secunia_research/2006-12/advisory/
CVE: CVE-2006-3466
Published: 2006-07-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-3600.  Reason: This candidate is a reservation duplicate of CVE-2006-3600.  Notes: All CVE users should reference CVE-2006-3600 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-3467
Published: 2006-07-21
Description: Integer overflow in FreeType before 2.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PCF file, as demonstrated by the Red Hat bad1.pcf test file, due to a partial fix of CVE-2006-1861.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U; http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=190593; http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
CVE: CVE-2006-3468
Published: 2006-07-21
Description: Linux kernel 2.6.x, when using both NFS and EXT3, allows remote attackers to cause a denial of service (file system panic) via a crafted UDP packet with a V2 lookup procedure that specifies a bad file handle (inode number), which triggers an error and causes an exported directory to be remounted read-only.
CVSS Score: 7.8 (HIGH)
References: http://lkml.org/lkml/2006/7/17/41; http://secunia.com/advisories/21369; http://secunia.com/advisories/21605
CVE: CVE-2006-3469
Published: 2006-07-21
Description: Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function, which is later used in a formatted print call to display the error message.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-134
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=375694; http://bugs.mysql.com/bug.php?id=20729; http://dev.mysql.com/doc/refman/4.1/en/news-4-1-21.html
CVE: CVE-2006-3589
Published: 2006-07-21
Description: vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause an SSL key file to be created with an unsafe umask that allows local users to read or modify the SSL key.
CVSS Score: 3.6 (LOW)
References: http://kb.vmware.com/kb/2467205; http://secunia.com/advisories/21120; http://secunia.com/advisories/23680
CVE: CVE-2006-3627
Published: 2006-07-21
Description: Unspecified vulnerability in the GSM BSSMAP dissector in Wireshark (aka Ethereal) 0.10.11 to 0.99.0 allows remote attackers to cause a denial of service (crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P; http://rhn.redhat.com/errata/RHSA-2006-0602.html; http://secunia.com/advisories/21078
CVE: CVE-2006-3628
Published: 2006-07-21
Description: Multiple format string vulnerabilities in Wireshark (aka Ethereal) 0.10.x to 0.99.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) ANSI MAP, (2) Checkpoint FW-1, (3) MQ, (4) XML, and (5) NTP dissectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P; http://rhn.redhat.com/errata/RHSA-2006-0602.html; http://secunia.com/advisories/21078
CVE: CVE-2006-3629
Published: 2006-07-21
Description: Unspecified vulnerability in the MOUNT dissector in Wireshark (aka Ethereal) 0.9.4 to 0.99.0 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P; http://rhn.redhat.com/errata/RHSA-2006-0602.html; http://secunia.com/advisories/21078
CVE: CVE-2006-3630
Published: 2006-07-21
Description: Multiple off-by-one errors in Wireshark (aka Ethereal) 0.9.7 to 0.99.0 have unknown impact and remote attack vectors via the (1) NCP NMAS and (2) NDPS dissectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P; http://rhn.redhat.com/errata/RHSA-2006-0602.html; http://secunia.com/advisories/21078
CVE: CVE-2006-3631
Published: 2006-07-21
Description: Unspecified vulnerability in the SSH dissector in Wireshark (aka Ethereal) 0.9.10 to 0.99.0 allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P; http://rhn.redhat.com/errata/RHSA-2006-0602.html; http://secunia.com/advisories/21078
CVE: CVE-2006-3632
Published: 2006-07-21
Description: Buffer overflow in Wireshark (aka Ethereal) 0.8.16 to 0.99.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the NFS dissector.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P; http://rhn.redhat.com/errata/RHSA-2006-0602.html; http://secunia.com/advisories/21078
CVE: CVE-2006-3679
Published: 2006-07-21
Description: FatWire Content Server 5.5.0 allows remote attackers to bypass access restrictions and obtain administrative privileges via unspecified attack vectors in the authentication process.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0242.html; http://secunia.com/advisories/21020; http://www.osvdb.org/27092
CVE: CVE-2006-3680
Published: 2006-07-21
Description: Cross-site scripting (XSS) vulnerability in photocycle in Photocycle 1.0 allows remote attackers to inject arbitrary web script or HTML via the phpage parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/21054; http://securitytracker.com/id?1016492; http://www.osvdb.org/27093
CVE: CVE-2006-3681
Published: 2006-07-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.
CVSS Score: 2.6 (LOW)
References: http://pridels0.blogspot.com/2006/04/awstats-65x-multiple-vuln.html; http://secunia.com/advisories/19725; http://secunia.com/advisories/22306
CVE: CVE-2006-3682
Published: 2006-07-21
Description: awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month parameters.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2006/04/awstats-65x-multiple-vuln.html; http://secunia.com/advisories/19725; http://secunia.com/advisories/22306
CVE: CVE-2006-3683
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in poll.php in Flipper Poll 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1269&w=2; http://packetstormsecurity.org/0606-exploits/flipper.txt; http://secunia.com/advisories/20632
CVE: CVE-2006-3684
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in calendar.php in SoftComplex PHP Event Calendar 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_calendar parameter, which overwrites the $path_to_calendar variable from an extract function call.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21074; http://secunia.com/advisories/21417; http://www.securityfocus.com/archive/1/440265/100/0/threaded
CVE: CVE-2006-3685
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in CzarNews 1.12 through 1.14 allows remote attackers to execute arbitrary PHP code via a URL in the tpath parameter to cn_config.php.  NOTE: the news.php vector is already covered by CVE-2005-0859.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21038; http://www.vupen.com/english/advisories/2006/2806; https://exchange.xforce.ibmcloud.com/vulnerabilities/27733
CVE: CVE-2006-3686
Published: 2006-07-21
Description: Unspecified vulnerability in [SYSEXE]SMPUTIL.EXE in HP OpenVMS 7.3-2 allows local users and "remote users" to cause a denial of service (crash).
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.itrc.hp.com/openvms_patches/alpha/V7.3-2/VMS732_MP-V0100.txt; http://secunia.com/advisories/21067; http://securitytracker.com/id?1016509
CVE: CVE-2006-3687
Published: 2006-07-21
Description: Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in D-Link DI-524, DI-604 Broadband Router, DI-624, D-Link DI-784, WBR-1310 Wireless G Router, WBR-2310 RangeBooster G Router, and EBR-2310 Ethernet Broadband Router allows remote attackers to execute arbitrary code via a long M-SEARCH request to UDP port 1900.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0363.html; http://secunia.com/advisories/21081; http://securitytracker.com/id?1016511
CVE: CVE-2006-3688
Published: 2006-07-21
Description: SQL injection vulnerability in Room.php in Francisco Charrua Photo-Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/21084; http://securitytracker.com/id?1016505; http://www.securityfocus.com/archive/1/440124/100/100/threaded
CVE: CVE-2006-3689
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in user-func.php in Codeworks Gnomedia SubberZ[Lite] allows remote attackers to execute arbitrary PHP code via a URL in the myadmindir parameter.  NOTE: this issue has been disputed by a third party that claims that " the myadmindir variable is set before any GET variables are processed.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1246; http://www.osvdb.org/28592; http://www.securityfocus.com/archive/1/440139/100/0/threaded
CVE: CVE-2006-3690
Published: 2006-07-21
Description: Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to (1) components/com_minibb.php or (2) components/minibb/index.php.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv39-matdhule-2006.txt; http://securityreason.com/securityalert/1245; http://securitytracker.com/id?1016507
CVE: CVE-2006-3691
Published: 2006-07-21
Description: Multiple SQL injection vulnerabilities in VBZooM 1.11 and earlier allow remote attackers to execute arbitrary SQL commands via the UserID parameter to (1) ignore-pm.php, (2) sendmail.php, (3) reply.php or (4) sub-join.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1244; http://www.osvdb.org/28254; http://www.securityfocus.com/archive/1/440114/100/0/threaded
CVE: CVE-2006-3692
Published: 2006-07-21
Description: PHP remote file inclusion vulnerability in enduser/listmessenger.php in ListMessenger 0.9.3 allows remote attackers to execute arbitrary PHP code via a URL in the lm_path parameter.  NOTE: the vendor has disputed this issue to SecurityTracker, stating that the $lm_path variable is set to a constant value.  As of 20060726, CVE concurs with the vendor based on SecurityTracker's post-disclosure analysis
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1243; http://securitytracker.com/id?1016530; http://www.attrition.org/pipermail/vim/2006-July/000946.html
CVE: CVE-2006-3693
Published: 2006-07-21
Description: Rocks Clusters 4.1 and earlier allows local users to gain privileges via commands enclosed with escaped backticks (\`) in an argument to the (1) mount-loop (mount-loop.c) or (2) umount-loop (umount-loop.c) command, which is not filtered in a system function call.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21065; http://securityreason.com/securityalert/1242; http://www.securityfocus.com/archive/1/440126/100/0/threaded
CVE: CVE-2006-3694
Published: 2006-07-21
Description: Multiple unspecified vulnerabilities in Ruby before 1.8.5 allow remote attackers to bypass "safe level" checks via unspecified vectors involving (1) the alias function and (2) "directory operations".
CVSS Score: 6.4 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html; http://jvn.jp/jp/JVN%[PII_REDACTED]/index.html
CVE: CVE-2006-3695
Published: 2006-07-21
Description: Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. NOTE: this might be related to CVE-2006-3458.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/20958; http://secunia.com/advisories/21534; http://securitytracker.com/id?1016457
CVE: CVE-2006-3696
Published: 2006-07-21
Description: filtnt.sys in Outpost Firewall Pro before 3.51.759.6511 (462) allows local users to cause a denial of service (crash) via long arguments to mshta.exe.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/21095; http://securityreason.com/securityalert/1247; http://www.securityfocus.com/archive/1/440427
CVE: CVE-2006-3697
Published: 2006-07-21
Description: Agnitum Outpost Firewall Pro 3.51.759.6511 (462), as used in (1) Lavasoft Personal Firewall 1.0.543.5722 (433) and (2) Novell BorderManager Novell Client Firewall 2.0, does not properly restrict user activities in application windows that run in a LocalSystem context, which allows local users to gain privileges and execute commands (a) via the "open folder" option when no instance of explorer.exe is running, possibly related to the ShellExecute API function; or (b) by overwriting a batch file through the "Save Configuration As" option. NOTE: this might be a vulnerability in Microsoft Windows and explorer.exe instead of the firewall.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/21088; http://secunia.com/advisories/21089; http://www.ben.goulding.com.au/secad.html
CVE: CVE-2006-3698
Published: 2006-07-21
Description: Multiple unspecified vulnerabilities in Oracle Database 10.1.0.5 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB01 for Change Data Capture (CDC) component and (2) DB03 for Data Pump Metadata API.  NOTE: as of 20060719, Oracle has not disputed a claim by a reliable researcher that DB01 is related to multiple SQL injection vulnerabilities in SYS.DBMS_CDC_IMPDP using the (a) IMPORT_CHANGE_SET, (b) IMPORT_CHANGE_TABLE, (c) IMPORT_CHANGE_COLUMN, (d) IMPORT_SUBSCRIBER, (e) IMPORT_SUBSCRIBED_TABLE, (f) IMPORT_SUBSCRIBED_COLUMN, (g) VALIDATE_IMPORT, (h) VALIDATE_CHANGE_SET, (i) VALIDATE_CHANGE_TABLE, and (j) VALIDATE_SUBSCRIPTION procedures, and that DB03 is for SQL injection in the MAIN procedure for SYS.KUPW$WORKER.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047994.html; http://secunia.com/advisories/21111; http://secunia.com/advisories/21165
CVE: CVE-2006-3699
Published: 2006-07-21
Description: Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5 and 9.2.0.6 has unknown impact and attack vectors, aka Oracle Vuln# DB02.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3700
Published: 2006-07-21
Description: Multiple unspecified vulnerabilities in Oracle Database 9.2.0.6 and 10.1.0.4 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB04 for Web Distributed Authoring and Versioning (DAV) and (2) DB23 for XMLDB.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529
CVE: CVE-2006-3701
Published: 2006-07-21
Description: Unspecified vulnerability in the Dictionary component in Oracle Database 8.1.7.4, 9.0.1.5, and 9.2.0.6 has unknown impact and attack vectors, aka Oracle Vuln# DB05.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/21111; http://secunia.com/advisories/21165; http://securitytracker.com/id?1016529