deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-5260
Published: 2006-10-12
Description: PHP remote file inclusion vulnerability in compteur.php in Compteur 2 allows remote attackers to execute arbitrary PHP code via a URL in the cp parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22373; http://www.osvdb.org/29618; http://www.vupen.com/english/advisories/2006/3997
CVE: CVE-2006-5261
Published: 2006-10-12
Description: Multiple PHP remote file inclusion vulnerabilities in PHPMyNews 1.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the cfg_include_dir parameter in (1) disp_form.php3, (2) disp_smileys.php3, (3) little_news.php3, and (4) index.php3 in include/.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1720; http://www.securityfocus.com/archive/1/448015/100/0/threaded; http://www.securityfocus.com/bid/20396
CVE: CVE-2006-5262
Published: 2006-10-12
Description: CRLF injection vulnerability in lib/session.php in Hastymail 1.5 and earlier before 20061008 allows remote authenticated users to send arbitrary IMAP commands via a CRLF sequence in a mailbox name.  NOTE: the attack crosses privilege boundaries if the IMAP server configuration prevents a user from establishing a direct IMAP session.
CVSS Score: 6.5 (MEDIUM)
References: http://hastymail.sourceforge.net/security.php; http://secunia.com/advisories/22308; http://www.securityfocus.com/archive/1/453417/100/0/threaded
CVE: CVE-2006-5263
Published: 2006-10-12
Description: Directory traversal vulnerability in templates/header.php3 in phpMyAgenda 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter, as demonstrated by a parameter value naming an Apache HTTP Server log file that apparently contains PHP code.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22346; http://www.securityfocus.com/bid/20453; http://www.vupen.com/english/advisories/2006/4005
CVE: CVE-2006-5264
Published: 2006-10-12
Description: Cross-site scripting (XSS) vulnerability in sql.php in MysqlDumper 1.21 b6 allows remote attackers to inject arbitrary web script or HTML via the db parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/22392; http://securityreason.com/securityalert/1712; http://www.securityfocus.com/archive/1/448269/100/0/threaded
CVE: CVE-2006-5280
Published: 2006-10-13
Description: PHP remote file inclusion vulnerability in includes/import-archive.php in Leicestershire communityPortals 1.0 build 20051018 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cp_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/22381; http://www.osvdb.org/29670; http://www.securityfocus.com/bid/20479
CVE: CVE-2006-5281
Published: 2006-10-13
Description: PHP remote file inclusion vulnerability in naboard_pnr.php in n@board 3.1.9e and earlier allows remote attackers to execute arbitrary PHP code via a URL in the skin parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22250; http://securitydot.net/txt/id/1645/type/xpl/; http://www.osvdb.org/29692
CVE: CVE-2006-5282
Published: 2006-10-13
Description: Multiple PHP remote file inclusion vulnerabilities in SH-News 3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the scriptpath parameter to (1) report.php, (2) archive.php, (3) comments.php, (4) init.php, or (5) news.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22316; http://www.securityfocus.com/archive/1/471413/100/0/threaded; http://www.securityfocus.com/bid/20478
CVE: CVE-2006-5283
Published: 2006-10-13
Description: PHP remote file inclusion vulnerability in ftag.php in Minichat 6.0 allows remote attackers to execute arbitrary PHP code via a URL in the mostrar parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22321; http://www.securityfocus.com/bid/20482; http://www.vupen.com/english/advisories/2006/4012
CVE: CVE-2006-5284
Published: 2006-10-13
Description: PHP remote file inclusion vulnerability in auth/phpbb.inc.php in Shen Cheng-Da PHP News Reader (aka pnews) 2.6.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CFG[auth_phpbb_path] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22354; http://www.securityfocus.com/bid/20480; http://www.vupen.com/english/advisories/2006/4011
CVE: CVE-2006-5285
Published: 2006-10-13
Description: SQL injection vulnerability in index.php in XeoPort 0.81, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the xp_body_text parameter.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]4422&w=2; http://securityreason.com/securityalert/1735; http://securitytracker.com/id?1017055
CVE: CVE-2006-5286
Published: 2006-10-13
Description: Unspecified vulnerability in IKE.NLM in Novell BorderManager 3.8 allows attackers to cause a denial of service (crash) via unknown attack vectors related to "VPN issues" for certain "IKE and IPsec settings."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22355; http://securitytracker.com/id?1017025; http://support.novell.com/cgi-bin/search/searchtid.cgi?/2974551.htm
CVE: CVE-2006-5287
Published: 2006-10-13
Description: Multiple SQL injection vulnerabilities in sign.php in Xeobook 0.93 allow remote attackers to execute arbitrary SQL commands via (1) the User-Agent HTTP header, or the (2) gb_entry_text, (3) gb_location, (4) gb_fullname, or (5) gb_sex parameters.
CVSS Score: 5.1 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2705&w=2; http://www.securityfocus.com/archive/1/448425/100/0/threaded; http://www.securityfocus.com/bid/20476
CVE: CVE-2006-5288
Published: 2006-10-13
Description: Cisco 2700 Series Wireless Location Appliances before 2.1.34.0 have a default administrator username "root" and password "password," which allows remote attackers to obtain administrative privileges, aka Bug ID CSCsb92893.
CVSS Score: 10.0 (HIGH)
References: http://securitytracker.com/id?1017056; http://www.cisco.com/en/US/products/products_security_advisory09186a0080758bae.shtml; http://www.osvdb.org/30913
CVE: CVE-2006-5289
Published: 2006-10-13
Description: Multiple PHP remote file inclusion vulnerabilities in Vtiger CRM 4.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the calpath parameter to (1) modules/Calendar/admin/update.php, (2) modules/Calendar/admin/scheme.php, or (3) modules/Calendar/calendar.php.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv54-theday-2006.txt; http://securityreason.com/securityalert/1722; http://www.securityfocus.com/archive/1/448092/100/0/threaded
CVE: CVE-2006-5290
Published: 2006-10-13
Description: The ESS/ Network Controller and MicroServer Web Server components of Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265 and 275 allow remote attackers to bypass authentication and execute arbitrary code via "WebUI command injection on TCP/IP hostname."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22252; http://securitytracker.com/id?1016981; http://www.securityfocus.com/bid/20334/info
CVE: CVE-2006-5291
Published: 2006-10-16
Description: PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control.class.php in Download-Engine 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter.  NOTE: CVE analysis suggests that this issue is actually in a third party product, SPAW Editor PHP Edition, so this issue is probably a duplicate of CVE-2006-4656.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/22383; http://securityreason.com/securityalert/1723; http://spaw.cvs.sourceforge.net/spaw/spaw/docs/ChangeLog.txt?view=markup
CVE: CVE-2006-5292
Published: 2006-10-16
Description: PHP remote file inclusion vulnerability in photo_comment.php in Exhibit Engine 1.5 RC 4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/20447; https://exchange.xforce.ibmcloud.com/vulnerabilities/29424; https://www.exploit-db.com/exploits/2509
CVE: CVE-2006-5293
Published: 2006-10-16
Description: Cross-site scripting (XSS) vulnerability in index.php in PhpOutsourcing Noah's Classifieds 1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the frommethod parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1724; http://www.securityfocus.com/archive/1/448296/100/0/threaded; http://www.securityfocus.com/bid/20463
CVE: CVE-2006-5294
Published: 2006-10-16
Description: Cross-site scripting (XSS) vulnerability in index.php in phplist before 2.10.3 allows remote attackers to inject arbitrary web script or HTML via the unsubscribeemail parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://mantis.phplist.com/changelog_page.php; http://secunia.com/advisories/22405; http://securityreason.com/securityalert/1728
CVE: CVE-2006-4154
Published: 2006-10-16
Description: Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a set_var function call in (1) tcl_cmds.c and (2) tcl_core.c.
CVSS Score: 6.8 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=421; http://secunia.com/advisories/22458; http://secunia.com/advisories/22549
CVE: CVE-2006-5296
Published: 2006-10-16
Description: PowerPoint in Microsoft Office 2003 does not properly handle a container object whose position value exceeds the record length, which allows user-assisted attackers to cause a denial of service (NULL dereference and application crash) via a crafted PowerPoint (.PPT) file, as demonstrated by Nanika.ppt, and a different vulnerability than CVE-2006-3435, CVE-2006-3876, CVE-2006-3877, and CVE-2006-4694. NOTE: the impact of this issue was originally claimed to be arbitrary code execution, but later analysis demonstrated that this was erroneous.
CVSS Score: 4.3 (MEDIUM)
References: http://blogs.technet.com/msrc/archive/2006/10/12/poc-published-for-ms-office-2003-powerpoint.aspx; http://blogs.technet.com/msrc/archive/2006/11/10/follow-up-information-on-weblog-posting-about-poc-published-for-ms-office-2003-powerpoint.aspx; http://research.eeye.com/html/alerts/zeroday/20061012_2.html
CVE: CVE-2006-5297
Published: 2006-10-16
Description: Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.
CVSS Score: 1.2 (LOW)
References: http://marc.info/?l=mutt-dev&m=[PII_REDACTED]6292&w=2; http://secunia.com/advisories/22613; http://secunia.com/advisories/22640
CVE: CVE-2006-5298
Published: 2006-10-16
Description: The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls.
CVSS Score: 1.2 (LOW)
References: http://marc.info/?l=mutt-dev&m=[PII_REDACTED]6292&w=2; http://secunia.com/advisories/22613; http://secunia.com/advisories/22640
CVE: CVE-2006-4182
Published: 2006-10-16
Description: Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when less memory is allocated than expected.
CVSS Score: 7.5 (HIGH)
References: http://docs.info.apple.com/article.html?artnum=304829; http://kolab.org/security/kolab-vendor-notice-13.txt; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=422
CVE: CVE-2006-5210
Published: 2006-10-16
Description: Directory traversal vulnerability in IronWebMail before 6.1.1 HotFix-17 allows remote attackers to read arbitrary files via a GET request to the IM_FILE identifier with double-url-encoded "../" sequences ("%252e%252e/").
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/22406; http://securityreason.com/securityalert/1726; http://securitytracker.com/id?1017069
CVE: CVE-2006-5295
Published: 2006-10-16
Description: Unspecified vulnerability in ClamAV before 0.88.5 allows remote attackers to cause a denial of service (scanning service crash) via a crafted Compressed HTML Help (CHM) file that causes ClamAV to "read an invalid memory location."
CVSS Score: 5.0 (MEDIUM)
References: http://kolab.org/security/kolab-vendor-notice-13.txt; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=423; http://secunia.com/advisories/22370
CVE: CVE-2006-5299
Published: 2006-10-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Gcontact 0.6.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1725; http://www.armorize.com/advisory.php?Keyword=Armorize-ADV-2006-0005; http://www.securityfocus.com/archive/1/448692/100/0/threaded
CVE: CVE-2006-5300
Published: 2006-10-17
Description: Unspecified vulnerability in HP Version Control Agent before 2.1.5 allows remote authenticated users to obtain "unauthorized access" to a remote Repository Manager account and potentially gain privileges via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/22399; http://securityreason.com/securityalert/1727; http://securitytracker.com/id?1017042
CVE: CVE-2006-5301
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in includes/antispam.php in the SpamBlockerMODv 1.0.2 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2083&w=2; http://secunia.com/advisories/22356; http://www.securityfocus.com/bid/20501
CVE: CVE-2006-5302
Published: 2006-10-17
Description: Multiple PHP remote file inclusion vulnerabilities in Redaction System 1.0000 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang_prefix parameter to (a) conn.php, (b) sesscheck.php, (c) wap/conn.php, or (d) wap/sesscheck.php, or the (2) lang parameter to (e) index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://redactionsystem.sourceforge.net/index.php?m=news&id=2; http://redactionsystem.sourceforge.net/index.php?m=news&id=5; http://secunia.com/advisories/22347
CVE: CVE-2006-5303
Published: 2006-10-17
Description: Secure Computing SafeWord RemoteAccess 2.1 allows local users to obtain the UserCenter webportal password, database encryption keys, and signing keys by reading (1) base-64 encoded data in SERVERS\Web\Tomcat\usercenter\WEB-INF\login.conf and (2) plaintext data in SERVERS\Shared\signers.cfg.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/22081; http://www.securityfocus.com/bid/20509; https://exchange.xforce.ibmcloud.com/vulnerabilities/29515
CVE: CVE-2006-5304
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in inc/settings.php in IncCMS Core 1.0.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22420; http://www.rahim.webd.pl/exploity/Exploits/100.txt; http://www.securityfocus.com/bid/20531
CVE: CVE-2006-5305
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in lat2cyr.php in the lat2cyr 1.0.1 and earlier phpbb module allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/22432; http://securityreason.com/securityalert/1729; http://www.securityfocus.com/archive/1/448660/100/0/threaded
CVE: CVE-2006-5306
Published: 2006-10-17
Description: Multiple PHP remote file inclusion vulnerabilities in the Journals System module 1.0.2 (RC2) and earlier for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) includes/journals_delete.php, (2) includes/journals_post.php, or (3) includes/journals_edit.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/22387; http://securityreason.com/securityalert/1731; http://securitytracker.com/id?1017058
CVE: CVE-2006-5307
Published: 2006-10-17
Description: Multiple PHP remote file inclusion vulnerabilities in AFGB GUESTBOOK 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the Htmls parameter in (1) add.php, (2) admin.php, (3) look.php, or (4) re.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22363; http://www.osvdb.org/29725; http://www.osvdb.org/29726
CVE: CVE-2006-5308
Published: 2006-10-17
Description: Multiple PHP remote file inclusion vulnerabilities in Open Conference Systems (OCS) before 1.1.6 allow remote attackers to execute arbitrary PHP code via a URL in the fullpath parameter in (1) include/theme.inc.php or (2) include/footer.inc.php.
CVSS Score: 7.5 (HIGH)
References: http://isc.sans.org/diary.php?storyid=1791; http://pkp.sfu.ca/ocs_download; http://pkp.sfu.ca:8043/bugzilla/attachment.cgi?id=90
CVE: CVE-2006-5309
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in language/lang_french/lang_prillian_faq.php in the Prillian French 0.8.0 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22430; http://securityreason.com/securityalert/1732; http://www.securityfocus.com/archive/1/448663/100/0/threaded
CVE: CVE-2006-5310
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in common/visiteurs/include/menus.inc.php in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences (phpMyConference) 8.0.2 and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the lvc_include_dir parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/22411; http://securityreason.com/securityalert/1733; http://www.securityfocus.com/archive/1/448547/100/0/threaded
CVE: CVE-2006-5311
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in includes/archive/archive_topic.php in Buzlas 2006-1 Full allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1730; http://www.securityfocus.com/archive/1/448577/100/0/threaded; http://www.securityfocus.com/bid/20511
CVE: CVE-2006-5312
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/29510; https://www.exploit-db.com/exploits/2532; https://exchange.xforce.ibmcloud.com/vulnerabilities/29510
CVE: CVE-2006-4342
Published: 2006-10-17
Description: The kernel in Red Hat Enterprise Linux 3, when running on SMP systems, allows local users to cause a denial of service (deadlock) by running the shmat function on an shm at the same time that shmctl is removing that shm (IPC_RMID), which prevents a spinlock from being unlocked.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: http://secunia.com/advisories/22497; http://secunia.com/advisories/23064; http://support.avaya.com/elmodocs2/security/ASA-2006-254.htm
CVE: CVE-2006-5313
Published: 2006-10-17
Description: Hastymail 1.5 and earlier before 20061008 allows remote authenticated users to send arbitrary SMTP commands by placing them after a CRLF.CRLF sequence in the smtp_message parameter.  NOTE: this crosses privilege boundaries if the SMTP server configuration prevents a user from establishing a direct SMTP session.  NOTE: this is a different type of issue than CVE-2006-5262.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://hastymail.sourceforge.net/security.php; http://secunia.com/advisories/22308; http://www.securityfocus.com/archive/1/453417/100/0/threaded
CVE: CVE-2006-5314
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in ftag.php in TribunaLibre 3.12 Beta allows remote attackers to execute arbitrary PHP code via a URL in the mostrar parameter.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/13061007.txt; http://securityreason.com/securityalert/1734; http://www.securityfocus.com/archive/1/448096/100/0/threaded
CVE: CVE-2006-5315
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in main.php in registroTL allows remote attackers to execute arbitrary PHP code via an ftp:// URL in the page parameter.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/13061007.txt; http://securityreason.com/securityalert/1734; http://www.securityfocus.com/archive/1/448096/100/0/threaded
CVE: CVE-2006-5316
Published: 2006-10-17
Description: registroTL stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for /usuarios.dat.
CVSS Score: 7.8 (HIGH)
References: http://acid-root.new.fr/poc/13061007.txt; http://securityreason.com/securityalert/1734; http://www.securityfocus.com/archive/1/448096/100/0/threaded
CVE: CVE-2006-5317
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in index.php in eboli allows remote attackers to execute arbitrary PHP code via a URL in the contentSpecial parameter.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/13061007.txt; http://securityreason.com/securityalert/1734; http://www.securityfocus.com/archive/1/448096/100/0/threaded
CVE: CVE-2006-5318
Published: 2006-10-17
Description: PHP remote file inclusion vulnerability in index.php in Nayco JASmine (aka Jasmine-Web) allows remote attackers to execute arbitrary PHP code via an FTP URL in the section parameter.
CVSS Score: 7.5 (HIGH)
References: http://acid-root.new.fr/poc/13061007.txt; http://secunia.com/advisories/22374; http://www.securityfocus.com/archive/1/448096/100/0/threaded
CVE: CVE-2006-5319
Published: 2006-10-17
Description: Directory traversal vulnerability in redir.php in Foafgen 0.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the foaf parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://acid-root.new.fr/poc/13061007.txt; http://secunia.com/advisories/22376; http://securityreason.com/securityalert/1734
CVE: CVE-2006-5320
Published: 2006-10-17
Description: Directory traversal vulnerability in getimg.php in Album Photo Sans Nom 1.6 allows remote attackers to read arbitrary files via the img parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://acid-root.new.fr/poc/13061007.txt; http://secunia.com/advisories/22375; http://www.attrition.org/pipermail/vim/2006-December/001193.html
CVE: CVE-2006-5321
Published: 2006-10-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in phplist before 2.10.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://tincan.co.uk/?lid=1821; http://www.phplist.com/news; http://www.securityfocus.com/bid/20483