deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-5944
Published: 2006-11-17
Description: Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=17; http://secunia.com/advisories/22914; http://securityreason.com/securityalert/1876
CVE: CVE-2006-5945
Published: 2006-11-17
Description: Multiple SQL injection vulnerabilities in MGinternet Car Site Manager (CSM) allow remote attackers to execute arbitrary SQL commands via the (1) p parameter to (a) csm/asp/detail.asp, or the (2) l, (3) typ, or (4) loc parameter to (b) csm/asp/listings.asp.
CVSS Score: 7.5 (HIGH)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=17; http://secunia.com/advisories/22914; http://securityreason.com/securityalert/1876
CVE: CVE-2006-5946
Published: 2006-11-17
Description: SQL injection vulnerability in demo/glossary/glossary.asp in FunkyASP Glossary 1.0 allows remote attackers to execute arbitrary SQL commands via the alpha parameter.
CVSS Score: 7.5 (HIGH)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=19; http://secunia.com/advisories/22911; http://securityreason.com/securityalert/1877
CVE: CVE-2006-5947
Published: 2006-11-17
Description: Multiple directory traversal vulnerabilities in Conxint FTP Server 2.2.0603, and possibly earlier, allow remote attackers to read arbitrary files and list arbitrary directories via directory traversal sequences in (1) DIR (LIST or NLST) and (2) GET (RETR) commands. NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22893; http://www.securityfocus.com/bid/21081; http://www.vupen.com/english/advisories/2006/4519
CVE: CVE-2006-5948
Published: 2006-11-17
Description: PHP remote file inclusion vulnerability in pntUnit/Inspect.php in phpPeanuts 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the Include parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22873; http://www.osvdb.org/30397; http://www.securityfocus.com/bid/21057
CVE: CVE-2006-5949
Published: 2006-11-17
Description: Directory traversal vulnerability in ALTools ALFTP FTP Server 4.1 beta 1, and possibly earlier, allows remote attackers to create arbitrary directories via directory traversal sequences in a MKD request.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22874; http://www.securityfocus.com/bid/21058; http://www.vupen.com/english/advisories/2006/4518
CVE: CVE-2006-5950
Published: 2006-11-17
Description: Unspecified vulnerability in ALTools ALFTP FTP Server 4.1 beta 1, and possibly earlier, allows remote authenticated users to obtain the installation path via unknown vectors related to the REN command, probably due to response messages.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22874; http://www.securityfocus.com/bid/21058; http://www.vupen.com/english/advisories/2006/4518
CVE: CVE-2006-5951
Published: 2006-11-17
Description: PHP remote file inclusion vulnerability in pipe.php in Exophpdesk 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1878; http://www.securityfocus.com/archive/1/451308/100/0/threaded; http://www.securityfocus.com/bid/21003
CVE: CVE-2006-5952
Published: 2006-11-17
Description: SQL injection vulnerability in admin/default.asp in ASP Smiley 1.0 allows remote attackers to execute arbitrary SQL commands via the Username field.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22884; http://www.securityfocus.com/bid/21063; http://www.vupen.com/english/advisories/2006/4515
CVE: CVE-2006-5953
Published: 2006-11-17
Description: SQL injection vulnerability in viewcart.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL commands via the zoneid parameter.
CVSS Score: 7.5 (HIGH)
References: http://s-a-p.ca/index.php?page=OurAdvisories&id=28; http://secunia.com/advisories/22912; http://www.securityfocus.com/archive/1/451549/100/100/threaded
CVE: CVE-2006-5954
Published: 2006-11-17
Description: SQL injection vulnerability in page.asp in NetVIOS 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the NewsID parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22901; http://www.osvdb.org/30411; http://www.securityfocus.com/bid/21088
CVE: CVE-2006-5955
Published: 2006-11-17
Description: SQL injection vulnerability in listings.asp in 20/20 DataShed (aka Real Estate Listing System) allows remote attackers to execute arbitrary SQL commands via the itemID parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://aria-security.net/advisory/Real%20Estate%20Listing%20System.txt; http://secunia.com/advisories/22894; http://www.securityfocus.com/archive/1/451503/100/200/threaded
CVE: CVE-2006-5956
Published: 2006-11-17
Description: XLineSoft PHPRunner 3.1 stores the (1) database server name, (2) database names, (3) usernames, and (4) passwords in plaintext in %WINDIR%\PHPRunner.ini, which allows local users to obtain sensitive information by reading the file.
CVSS Score: 2.1 (LOW)
References: http://lostmon.blogspot.com/2006/11/phprunner-database-credentials.html; http://secunia.com/advisories/22863; http://securitytracker.com/id?1017218
CVE: CVE-2006-5957
Published: 2006-11-17
Description: Multiple SQL injection vulnerabilities in INFINICART allow remote attackers to execute arbitrary SQL commands via the (1) groupid parameter in (a) browse_group.asp, (2) productid parameter in (b) added_to_cart.asp, and (3) catid and (4) subid parameter in (c) browsesubcat.asp.  NOTE: the vendor has disputed this report, saying "The vulnerabilities mentioned were never present in our official released products but only in the unofficial demo version. However we do appreciate the information. We have update our demo version and made sure all those vulnerabilities are fixed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/22865; http://securityreason.com/securityalert/1881; http://www.attrition.org/pipermail/vim/2006-December/001162.html
CVE: CVE-2006-5958
Published: 2006-11-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) password fields in (a) login.asp, (3) search field in (b) search.asp, and (4) email field in (c) sendpassword.asp.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22865; http://securityreason.com/securityalert/1881; http://www.securityfocus.com/archive/1/451322/100/0/threaded
CVE: CVE-2006-5959
Published: 2006-11-17
Description: SQL injection vulnerability in browse.asp in A+ Store E-Commerce allows remote attackers to execute arbitrary SQL commands via the ParentID parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-11/0248.html; http://secunia.com/advisories/22918/; http://securityreason.com/securityalert/1880
CVE: CVE-2006-5960
Published: 2006-11-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in account_login.asp in A+ Store E-Commerce allow remote attackers to inject arbitrary web script or HTML via the (1) username (txtUserName) and (2) password (txtPassword) parameters.  NOTE: portions of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-11/0248.html; http://secunia.com/advisories/22918/; http://securityreason.com/securityalert/1880
CVE: CVE-2006-5961
Published: 2006-11-17
Description: Buffer overflow in Mercury Mail Transport System 4.01b for Windows has unknown impact and attack vectors, as originally reported in a GLEG VulnDisco pack.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.  The original researcher is reliable.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22857; http://www.securityfocus.com/bid/21110; http://secunia.com/advisories/22857
CVE: CVE-2006-5962
Published: 2006-11-17
Description: Multiple SQL injection vulnerabilities in Hpecs Shopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields in the (a) login screen, and (3) searchstring parameter in (b) insearch_list.asp.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22904; http://securityreason.com/securityalert/1879; http://www.securityfocus.com/archive/1/451595/100/0/threaded
CVE: CVE-2006-5966
Published: 2006-11-17
Description: Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to (1) reboot the system using the Reinicializar method in the ActiveScan.1 ActiveX control, or (2) determine arbitrary file existence and size via the ObtenerTamano method in the PAVPZ.SOS.1 ActiveX control.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/21763; http://secunia.com/secunia_research/2006-64/advisory/; http://www.securityfocus.com/archive/1/451864/100/0/threaded
CVE: CVE-2006-5967
Published: 2006-11-17
Description: Race condition in Panda ActiveScan 5.53.00, and other versions before 5.54.01, allows remote attackers to cause memory corruption and execute arbitrary code via unknown vectors related to multiple invocations of the Analizar method in the ActiveScan.1 ActiveX control, which is not thread safe.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21763; http://secunia.com/secunia_research/2006-64/advisory/; http://www.securityfocus.com/archive/1/451864/100/0/threaded
CVE: CVE-2006-5968
Published: 2006-11-17
Description: MDaemon 9.0.5, 9.0.6, 9.51, and 9.53, and possibly other versions, installs the MDaemon application folder with insecure permissions (Users create files/directories), which allows local users to execute arbitrary code by creating malicious RASAPI32.DLL or MPRAPI.DLL libraries in the MDaemon\APP folder, which is an untrusted search path element due to insecure permissions.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21554; http://secunia.com/secunia_research/2006-67/advisory/; http://securityreason.com/securityalert/1890
CVE: CVE-2006-5793
Published: 2006-11-17
Description: The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html; http://bugs.gentoo.org/attachment.cgi?id=101400&action=view; http://bugs.gentoo.org/show_bug.cgi?id=154380
CVE: CVE-2006-5969
Published: 2006-11-17
Description: CRLF injection vulnerability in the evalFolderLine function in fvwm 2.5.18 and earlier allows local users to execute arbitrary commands via carriage returns in a directory name, which is not properly handled by fvwm-menu-directory, a variant of CVE-2003-1308.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/22961; http://secunia.com/advisories/23089; http://thread.gmane.org/gmane.comp.window-managers.fvwm.devel/2419/focus=2419
CVE: CVE-2006-5819
Published: 2006-11-18
Description: Verity Ultraseek before 5.7 allows remote attackers to use the server as a proxy for web attacks and host scanning via a direct request to the highlight/index.html script.
CVSS Score: 10.0 (HIGH)
References: http://securitytracker.com/id?1017235; http://www.kb.cert.org/vuls/id/559616; http://www.osvdb.org/22892
CVE: CVE-2006-5970
Published: 2006-11-18
Description: Verity Ultraseek before 5.7 allows remote attackers to obtain sensitive information via direct requests with (1) a null ("%00") terminated url parameter to help/urlstatusgo.html; or missing parameters to (2) help/header.html, (3) help/footer.html, (4) spell.html, (5) coreforma.html, (6) daterange.html, (7) hits.html, (8) hitsnavbottom.html, (9) indexform.html, (10) indexforma.html, (11) languages.html, (12) nohits.html, (13) onehit1.html, (14) onehit2.html, (15) query.html, (16) queryform0.html, (17) queryform0a.html, (18) queryform1.html, (19) queryform1a.html, (20) queryform2.html, (21) queryform2a.html, (22) quicklinks.html, (23) relatedtopics.html, (24) signin.html, (25) subtopics.html, (26) thesaurus.html, (27) topics.html, (28) hitspagebar.html, (29) highlight/highlight.html, (30) highlight/highlight_one.html, and (31) highlight/topnav.html, which leaks the installation path in the resulting error message.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22892; http://securitytracker.com/id?1017235; http://www.osvdb.org/30287
CVE: CVE-2006-5971
Published: 2006-11-18
Description: Absolute path traversal vulnerability in admin/logfile.txt in Verity Ultraseek before 5.6.2 allows remote attackers to read arbitrary files via the name variable.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22892; http://www.osvdb.org/30289; http://www.securityfocus.com/archive/1/451847/100/0/threaded
CVE: CVE-2006-4413
Published: 2006-11-18
Description: Apple Remote Desktop before 3.1 uses insecure permissions for certain built-in packages, which allows local users on an Apple Remote Desktop administration system to modify the packages and gain root privileges on client systems that use the packages.
CVSS Score: 7.2 (HIGH)
References: http://lists.apple.com/archives/security-announce/2006/Nov/msg00000.html; http://secunia.com/advisories/22982; http://securitytracker.com/id?1017241
CVE: CVE-2006-5972
Published: 2006-11-18
Description: Stack-based buffer overflow in WG111v2.SYS in NetGear WG111v2 wireless adapter (USB) allows remote attackers to execute arbitrary code via a long 802.11 beacon request.
CVSS Score: 10.0 (HIGH)
References: http://projects.info-pull.com/mokb/MOKB-16-11-2006.html; http://secunia.com/advisories/22962; http://securitytracker.com/id?1017245
CVE: CVE-2006-5973
Published: 2006-11-20
Description: Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap_disable is set to "yes," allows remote authenticated IMAP or POP3 users to cause a denial of service (crash) via unspecified vectors involving the cache file.
CVSS Score: 5.0 (MEDIUM)
References: http://dovecot.org/list/dovecot-news/2006-November/000023.html; http://dovecot.org/pipermail/dovecot-news/2006-November/000024.html; http://secunia.com/advisories/23007
CVE: CVE-2006-5975
Published: 2006-11-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) URL, or (3) Comments field.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22902; http://securityreason.com/securityalert/1882; http://www.securityfocus.com/archive/1/451563/100/0/threaded
CVE: CVE-2006-5976
Published: 2006-11-20
Description: Multiple SQL injection vulnerabilities in admin_login.asp in BlogMe 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password field.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22902; http://securityreason.com/securityalert/1882; http://www.securityfocus.com/archive/1/451563/100/0/threaded
CVE: CVE-2006-5977
Published: 2006-11-20
Description: Multiple SQL injection vulnerabilities in MultiCalendars allow remote attackers to execute arbitrary SQL commands via the (1) M or (2) Y parameter to rss_out.asp, or the (3) cate parameter to all_calendars.asp.  NOTE: the all_calendars.asp/calsids vector is already covered by CVE-2006-2293.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1883; http://www.securityfocus.com/archive/1/451642/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30301
CVE: CVE-2006-5978
Published: 2006-11-20
Description: Unspecified vulnerability in E-Xoopport before 2.2.0 has unknown impact and attack vectors, as addressed by "Some security fix."
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=463210; http://www.securityfocus.com/bid/21052; http://www.vupen.com/english/advisories/2006/4494
CVE: CVE-2006-5979
Published: 2006-11-20
Description: Renasoft NetJetServer 2.5.3.939, and possibly earlier, uses insecure permissions for Global.asa, which allows remote attackers to obtain sensitive information.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22859; http://www.vupen.com/english/advisories/2006/4559; https://exchange.xforce.ibmcloud.com/vulnerabilities/30338
CVE: CVE-2006-5980
Published: 2006-11-20
Description: adm_lgn_admin.asp in Renasoft NetJetServer 2.5.3.939, and possibly earlier, does not properly perform login authentication, which allows remote attackers to obtain administrative privileges.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/22859; http://www.vupen.com/english/advisories/2006/4559; https://exchange.xforce.ibmcloud.com/vulnerabilities/30337
CVE: CVE-2006-5981
Published: 2006-11-20
Description: Multiple directory traversal vulnerabilities in SeleniumServer FTP Server 1.0, and possibly earlier, allow remote attackers to list arbitrary directories, read arbitrary files, and upload arbitrary files via directory traversal sequences in the (1) DIR (LIST or NLST), (2) GET (RETR), and (3) PUT (STOR) commands.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/22928; http://whitestar.linuxbox.org/pipermail/exploits/2006-November/000037.html; http://www.osvdb.org/30448
CVE: CVE-2006-5982
Published: 2006-11-20
Description: SeleniumServer FTP Server 1.0, and possibly earlier, stores user passwords in plaintext in the Servers directory, which allows attackers to obtain passwords by reading the file.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://secunia.com/advisories/22928; http://www.osvdb.org/30449; http://www.vupen.com/english/advisories/2006/4540
CVE: CVE-2006-5983
Published: 2006-11-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user parameter to (a) CMD_SHOW_RESELLER or (b) CMD_SHOW_USER in the Admin level; the (2) TYPE parameter to (c) CMD_TICKET_CREATE or (d) CMD_TICKET, the (3) user parameter to (e) CMD_EMAIL_FORWARDER_MODIFY, (f) CMD_EMAIL_VACATION_MODIFY, or (g) CMD_FTP_SHOW, and the (4) name parameter to (h) CMD_EMAIL_LIST in the User level; or the (5) user parameter to (i) CMD_SHOW_USER in the Reseller level.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-79
References: http://aria-security.net/advisory/directadmin.txt; http://securityreason.com/securityalert/1885; http://www.securityfocus.com/archive/1/451376/100/0/threaded
CVE: CVE-2006-5984
Published: 2006-11-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) txtCompanyName, (2) txtEmail, or (3) txtUserAccNum parameter to (a) users.asp, or the (4) setThemeColour parameter to (b) default.asp in the Reseller and Admin levels; or the (5) setThemeColour parameter to default.asp in the User level.  NOTE: the txtDomainName parameter to domains.asp is covered by CVE-2006-1407, which suggests that this vector is fixed in 3.2.10 stable.
CVSS Score: 6.8 (MEDIUM)
References: http://aria-security.net/advisory/helm.txt; http://secunia.com/advisories/22916; http://securityreason.com/securityalert/1884
CVE: CVE-2006-5985
Published: 2006-11-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in admin/options.php in Extreme CMS 0.9, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) bg1, (2) bg2, (3) text, or (4) size parameters.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22919; http://www.vupen.com/english/advisories/2006/4529; http://secunia.com/advisories/22919
CVE: CVE-2006-5986
Published: 2006-11-20
Description: admin/options.php in Extreme CMS 0.9, and possibly earlier, does not require authentication, which might allow remote attackers to conduct unauthorized activities.  NOTE: this issue can be combined with another vulnerability to expand the scope of a cross-site scripting (XSS) attack without authentication.  NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22919; http://www.vupen.com/english/advisories/2006/4529; http://secunia.com/advisories/22919
CVE: CVE-2006-5987
Published: 2006-11-20
Description: SQL injection vulnerability in default.asp in ASPintranet, possibly 1.2, allows remote attackers to execute arbitrary SQL commands via the a parameter.
CVSS Score: 7.5 (HIGH)
References: http://aria-security.net/advisory/ASPintranet.txt; http://securityreason.com/securityalert/1886; http://www.securityfocus.com/archive/1/451504/100/0/threaded
CVE: CVE-2006-5988
Published: 2006-11-20
Description: Unspecified vulnerability in Windows 2000 Advanced Server SP4 running Active Directory allows remote attackers to cause a denial of service via unknown vectors, as demonstrated by a certain VulnDisco Pack module.  NOTE: the provenance of this information is unknown; the details are obtained from third party information. As of 20061116, this disclosure has no actionable information. However, since the VulnDisco Pack author is a reliable researcher, the disclosure is being assigned a CVE identifier for tracking purposes.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22871; http://www.securityfocus.com/bid/21083; http://secunia.com/advisories/22871
CVE: CVE-2006-5989
Published: 2006-11-20
Description: Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows remote attackers to cause a denial of service (crash) via a crafted Kerberos message that triggers a heap-based buffer overflow in the component array.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23023; http://secunia.com/advisories/23251; http://secunia.com/advisories/23681
CVE: CVE-2006-5990
Published: 2006-11-21
Description: VMWare VirtualCenter client 2.x before 2.0.1 Patch 1 (Build 33643) and 1.4.x before 1.4.1 Patch 1 (Build 33425), when server certificate verification is enabled, does not verify the server's X.509 certificate when creating an SSL session, which allows remote malicious servers to spoof valid servers via a man-in-the-middle attack.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://kb.vmware.com/kb/4646606; http://secunia.com/advisories/23053; http://securitytracker.com/id?1017270
CVE: CVE-2006-5991
Published: 2006-11-21
Description: Multiple SQL injection vulnerabilities in wwweb concepts CactuShop allow remote attackers to execute arbitrary SQL commands via the (1) prodtype parameter in prodtype.asp and the (2) product parameter in product.asp.
CVSS Score: 7.5 (HIGH)
References: http://aria-security.net/advisory/WWWeb%20Cocepts.txt; http://secunia.com/advisories/22895; http://securityreason.com/securityalert/1887