deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3979
Published: 2006-08-09
Description: The AdminAPI of ColdFusion MX 7 allows attackers to bypass authentication by using "programmatic access" to the adminAPI instead of the ColdFusion Administrator.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/21421; http://securitytracker.com/id?1016660; http://www.adobe.com/support/security/bulletins/apsb06-10.html
CVE: CVE-2006-4028
Published: 2006-08-09
Description: Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors.  NOTE: due to lack of details, it is not clear how these issues are different from CVE-2006-3389 and CVE-2006-3390, although it is likely that 2.0.4 addresses an unspecified issue related to "Anyone can register" functionality (user registration for guests).
CVSS Score: 10.0 (HIGH)
References: http://bugs.gentoo.org/show_bug.cgi?id=142142; http://secunia.com/advisories/21309; http://secunia.com/advisories/21447
CVE: CVE-2006-4029
Published: 2006-08-09
Description: Stack-based buffer overflow in sipd.dll in AGEphone 1.24 and 1.38.1 allows remote attackers to execute arbitrary code via a crafted UDP SIP packet.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2413&w=2; http://secunia.com/advisories/21175; http://securityreason.com/securityalert/1345
CVE: CVE-2006-3122
Published: 2006-08-09
Description: The supersede_lease function in memory.c in ISC DHCP (dhcpd) server 2.0pl5 allows remote attackers to cause a denial of service (application crash) via a DHCPDISCOVER packet with a 32 byte client-identifier, which causes the packet to be interpreted as a corrupt uid and causes the server to exit with "corrupt lease uid."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380273; http://secunia.com/advisories/21345; http://secunia.com/advisories/21363
CVE: CVE-2006-4031
Published: 2006-08-09
Description: MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously created MERGE table, even after the user's privileges are revoked for the original table, which might violate intended security policy.
CVSS Score: 2.1 (LOW)
References: http://bugs.mysql.com/bug.php?id=15195; http://dev.mysql.com/doc/refman/4.1/en/news-4-1-21.html; http://dev.mysql.com/doc/refman/5.0/en/news-5-0-24.html
CVE: CVE-2006-4032
Published: 2006-08-09
Description: Unspecified vulnerability in Cisco IOS CallManager Express (CME) allows remote attackers to gain sensitive information (user names) from the Session Initiation Protocol (SIP) user directory via certain SIP messages, aka bug CSCse92417.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21335; http://securitytracker.com/id?1016627; http://www.blackhat.com/html/bh-usa-06/bh-usa-06-speakers.html#Endler
CVE: CVE-2006-4033
Published: 2006-08-09
Description: Heap-based buffer overflow in Lhaplus.exe in Lhaplus 1.52, and possibly earlier versions, allows remote attackers to execute arbitrary code via an LZH archive with a long header, as specified by the extendedHeaderSize.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21256; http://securityreason.com/securityalert/1351; http://securitytracker.com/id?1016615
CVE: CVE-2006-4034
Published: 2006-08-09
Description: PHP remote file inclusion vulnerability in include/html/config.php in ModernGigabyte ModernBill 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the DIR parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/442126/100/0/threaded; http://www.securityfocus.com/bid/19335; http://www.solpotcrew.org/adv/solpot-adv-04.txt
CVE: CVE-2006-4035
Published: 2006-08-09
Description: SQL injection vulnerability in counterchaos.php in CounterChaos 0.48c and earlier allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0080.html; http://secunia.com/advisories/21356; http://securityreason.com/securityalert/1350
CVE: CVE-2006-4036
Published: 2006-08-09
Description: PHP remote file inclusion vulnerability in includes/usercp_register.php in ZoneMetrics ZoneX Publishers Gold Edition 1.0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21353; http://securityreason.com/securityalert/1348; http://www.attrition.org/pipermail/vim/2006-September/001017.html
CVE: CVE-2006-4037
Published: 2006-08-09
Description: Unspecified vulnerability in Fenestrae Faxination Server allows remote attackers to execute arbitrary code via a crafted packet.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21322; http://www.irmplc.com/Vendor_alerts.htm#alert8; http://www.securityfocus.com/bid/19328
CVE: CVE-2006-4038
Published: 2006-08-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in eintragen.php in GaesteChaos 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gastname or (2) gastwohnort parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]7745&w=2; http://secunia.com/advisories/21357; http://www.securityfocus.com/archive/1/442205/100/200/threaded
CVE: CVE-2006-4039
Published: 2006-08-09
Description: Multiple SQL injection vulnerabilities in eintragen.php in GaesteChaos 0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) gastname, (2) gastwohnort, or (3) gasteintrag parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]7745&w=2; http://secunia.com/advisories/21357; http://www.securityfocus.com/archive/1/442205/100/200/threaded
CVE: CVE-2006-4040
Published: 2006-08-09
Description: PHP remote file inclusion vulnerability in myevent.php in myWebland myEvent 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19680; http://www.osvdb.org/24725; http://www.securityfocus.com/bid/19246
CVE: CVE-2006-4041
Published: 2006-08-09
Description: SQL injection vulnerability in Pike before 7.6.86, when using a Postgres database server, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://pike.ida.liu.se/download/notes/7.6.86.xml; http://secunia.com/advisories/20494; http://secunia.com/advisories/21362
CVE: CVE-2006-4042
Published: 2006-08-09
Description: Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) title, (2) url, (3) excerpt, or (4) blog_name parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://retrogod.altervista.org/mybloggie_214_sql.html; http://secunia.com/advisories/21376; http://securityreason.com/securityalert/1347
CVE: CVE-2006-4043
Published: 2006-08-09
Description: index.php in myWebland myBloggie 2.1.4 and earlier allows remote attackers to obtain sensitive information via a query that only specifies the viewdate mode, which reveals the table prefix in a SQL error message.
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/mybloggie_214_sql.html; http://secunia.com/advisories/21376; http://securityreason.com/securityalert/1347
CVE: CVE-2006-4044
Published: 2006-08-09
Description: PHP remote file inclusion vulnerability in Beautifier/Core.php in Brad Fears phpCodeCabinet 0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the BEAUT_PATH parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0146.html; http://downloads.securityfocus.com/vulnerabilities/exploits/PHPCabinetRFIAugust052006.html; http://secunia.com/advisories/21386
CVE: CVE-2006-4045
Published: 2006-08-09
Description: PHP remote file inclusion vulnerability in news.php in Torbstoff News 4 allows remote attackers to execute arbitrary PHP code via a URL in the pfad parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21375; http://www.osvdb.org/27798; http://www.securityfocus.com/bid/19385
CVE: CVE-2006-4046
Published: 2006-08-09
Description: Multiple stack-based buffer overflows in Open Cubic Player 2.6.0pre6 and earlier for Windows, and 0.1.10_rc5 and earlier on Linux/BSD, allow remote attackers to execute arbitrary code via (1) a large .S3M file handled by the mpLoadS3M function, (2) a crafted .IT file handled by the itplayerclass::module::load function, (3) a crafted .ULT file handled by the mpLoadULT function, or (4) a crafted .AMS file handled by the mpLoadAMS function.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/ocpbof-adv.txt; http://secunia.com/advisories/21267; http://securityreason.com/securityalert/1349
CVE: CVE-2006-4047
Published: 2006-08-09
Description: SQL injection vulnerability in index.php in Netious CMS 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21347; http://www.osvdb.org/27788; http://www.securityfocus.com/bid/19419
CVE: CVE-2006-4048
Published: 2006-08-09
Description: Netious CMS 0.4 initializes session IDs based on the client IP address, which allows remote attackers to gain access to the administration section when originating from the same IP address as the administrator.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21347; http://www.osvdb.org/27789; http://www.securityfocus.com/bid/19421
CVE: CVE-2006-4049
Published: 2006-08-09
Description: Unspecified vulnerability in the utxconfig utility in Sun Ray Server Software 3.x allows local users to create or overwrite arbitrary files via unknown attack vectors.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/21398; http://securitytracker.com/id?1016647; http://sunsolve.sun.com/search/document.do?assetkey=1-26-101924-1
CVE: CVE-2006-4050
Published: 2006-08-10
Description: PHP remote file inclusion vulnerability in auto_check_renewals.php in phpAutoMembersArea (phpAMA) 3.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the installed_config_file parameter.
CVSS Score: 7.5 (HIGH)
References: http://dwalker.co.uk/forum/viewtopic.php?t=517; http://secunia.com/advisories/21373; http://securityreason.com/securityalert/1352
CVE: CVE-2006-4051
Published: 2006-08-10
Description: PHP remote file inclusion vulnerability in global.php in Turnkey Web Tools PHP Live Helper 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv43-matdhule-2006.txt; http://securityreason.com/securityalert/1369; http://securitytracker.com/id?1016639
CVE: CVE-2006-4052
Published: 2006-08-10
Description: Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Simple Shop 2.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter to (1) admin/index.php, (2) admin/adminindex.php, (3) admin/adminglobal.php, (4) admin/login.php, (5) admin/menu.php or (6) admin/header.php.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv44-matdhule-2006.txt; http://secunia.com/advisories/21371; http://securitytracker.com/id?1016644
CVE: CVE-2006-4053
Published: 2006-08-10
Description: PHP remote file inclusion vulnerability in templates/header.php in ME Download System 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the Vb8878b936c2bd8ae0cab parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21359; http://securityreason.com/securityalert/1355; http://www.bb-pcsecurity.de/sicherheit_282.htm
CVE: CVE-2006-4054
Published: 2006-08-10
Description: Multiple PHP remote file inclusion vulnerabilities in ME Download System 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) Vb8878b936c2bd8ae0cab parameter to (a) inc/sett_style.php or (b) inc/sett_smilies.php; or the (2) Vb6c4d0e18a204a63b38f, (3) V18a78b93c3adaaae84e2, or (4) V9ae5d2ca9e9e787969ff parameters to (c) inc/datei.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21359; http://www.osvdb.org/27766; http://www.osvdb.org/27767
CVE: CVE-2006-4055
Published: 2006-08-10
Description: Multiple PHP remote file inclusion vulnerabilities in Olaf Noehring The Search Engine Project (TSEP) 0.942 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the tsep_config[absPath] parameter to (1) include/colorswitch.php, (2) contentimages.class.php, (3) ipfunctions.php, (4) configfunctions.php, (5) printpagedetails.php, or (6) log.class.php.  NOTE: the copyright.php vector is already covered by CVE-2006-3993.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21291; http://securityreason.com/securityalert/1354; http://sourceforge.net/forum/forum.php?forum_id=597790
CVE: CVE-2006-4056
Published: 2006-08-10
Description: Multiple SQL injection vulnerabilities in the authentication process in katzlbt (a) The Address Book 1.04e and earlier and (b) The Address Book Reloaded before 2.0-rc4 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.  NOTE: portions of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21364; http://secunia.com/advisories/21379; http://sourceforge.net/project/shownotes.php?release_id=437760&group_id=172286
CVE: CVE-2006-4057
Published: 2006-08-10
Description: Buffer overflow in the preview_create function in gui.cpp in Mitch Murray Eremove 1.4 allows remote attackers to cause a denial of service (application crash), and possibly execute arbitrary code, via a large email attachment.
CVSS Score: 7.5 (HIGH)
References: http://advisories.echo.or.id/adv/adv42-theday-2006.txt; http://securityreason.com/securityalert/1368; http://securitytracker.com/id?1016640
CVE: CVE-2006-4058
Published: 2006-08-10
Description: Cross-site scripting (XSS) vulnerability in archive.php in Simplog 0.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyw parameter when performing a search.  NOTE: some details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21390; http://securityreason.com/securityalert/1358; http://securitytracker.com/id?1016651
CVE: CVE-2006-4059
Published: 2006-08-10
Description: Multiple PHP remote file inclusion vulnerabilities in USOLVED NEWSolved Lite 1.9.2, and possibly earlier, allow remote attackers to execute arbitrary PHP code via a URL in the abs_path parameter to (1) newsscript_lyt.php, (2) newsticker/newsscript_get.php, (3) inc/output/news_theme1.php, (4) inc/output/news_theme2.php, or (5) inc/output/news_theme3.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21395; http://securityreason.com/securityalert/1366; http://www.bb-pcsecurity.de/sicherheit_286.htm
CVE: CVE-2006-4060
Published: 2006-08-10
Description: PHP remote file inclusion vulnerability in calendar.php in Visual Events Calendar 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the cfg_dir parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21391; http://securityreason.com/securityalert/1364; http://securitytracker.com/id?1016646
CVE: CVE-2006-4061
Published: 2006-08-10
Description: PHP remote file inclusion vulnerability in index.php in Thomas Pequet phpPrintAnalyzer 1.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the rep_par_rapport_racine parameter.  NOTE: this issue has been disputed by third party researchers, stating that the rep_par_rapport_racine variable is initialized before use
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-08/0305.html; http://securitytracker.com/id?1016652; http://www.osvdb.org/29133
CVE: CVE-2006-4062
Published: 2006-08-10
Description: PHP remote file inclusion vulnerability in usr/extensions/get_tree.inc.php in Dmitry Sheiko SAPID Shop 1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[root_path] parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21414; http://www.vupen.com/english/advisories/2006/3198; https://exchange.xforce.ibmcloud.com/vulnerabilities/28255
CVE: CVE-2006-4063
Published: 2006-08-10
Description: Multiple PHP remote file inclusion vulnerabilities in Csaba Godor SAPID Blog Beta 2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) root_path parameter to (a) usr/extensions/get_blog_infochannel.inc.php, (b) usr/extensions/get_blog_meta_info.inc.php, or (c) usr/extensions/get_infochannel.inc.php; or the (2) GLOBALS[root_path] parameter to (d) usr/extensions/get_tree.inc.php.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/3196; https://exchange.xforce.ibmcloud.com/vulnerabilities/28251; https://www.exploit-db.com/exploits/2129
CVE: CVE-2006-4064
Published: 2006-08-10
Description: SQL injection vulnerability in default.asp in YenerTurk Haber Script 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: it was later reported reported that 2.0 is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/21397; http://www.osvdb.org/27825; http://www.securityfocus.com/archive/1/447653/100/0/threaded
CVE: CVE-2006-4065
Published: 2006-08-10
Description: Multiple PHP remote file inclusion vulnerabilities in Dmitry Sheiko SAPID Gallery 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) root_path parameter to (a) usr/extensions/get_calendar.inc.php or the (2) GLOBALS[root_path] parameter to (b) usr/extensions/get_tree.inc.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21413; http://www.vupen.com/english/advisories/2006/3197; https://exchange.xforce.ibmcloud.com/vulnerabilities/28254
CVE: CVE-2006-4066
Published: 2006-08-10
Description: The Graphical Device Interface Plus library (gdiplus.dll) in Microsoft Windows XP SP2 allows context-dependent attackers to cause a denial of service (application crash) via certain images that trigger a divide-by-zero error, as demonstrated by a (1) .ico file, (2) .png file that crashes MSN Messenger, and (3) .jpg file that crashes Internet Explorer.  NOTE: another researcher has not been able to reproduce this issue.
CVSS Score: 2.6 (LOW)
References: http://www.securityfocus.com/archive/1/441548/100/100/threaded; http://www.securityfocus.com/archive/1/441723/100/100/threaded; http://www.securityfocus.com/archive/1/441875/100/0/threaded
CVE: CVE-2006-4067
Published: 2006-08-10
Description: Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cakeforge.org/frs/shownotes.php?release_id=124; http://secunia.com/advisories/21383; http://www.securityfocus.com/bid/19372
CVE: CVE-2006-4068
Published: 2006-08-10
Description: The pswd.js script relies on the client to calculate whether a username and password match hard-coded hashed values for a server, and uses a hashing scheme that creates a large number of collisions, which makes it easier for remote attackers to conduct offline brute force attacks.  NOTE: this script might also allow attackers to generate the server-side "secret" URL without determining the original password, but this possibility was not discussed by the original researcher.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://securityreason.com/securityalert/1362; http://www.securityfocus.com/archive/1/442120; http://www.securityfocus.com/bid/19333
CVE: CVE-2006-4069
Published: 2006-08-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Elaine Aquino Online Zone Journals (OZJournals) 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) m and (2) c parameters in index.php, (3) a search action, and (4) a "submit comment" action.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21311; http://www.securityfocus.com/archive/1/442035/100/200/threaded; http://www.securityfocus.com/bid/19311
CVE: CVE-2006-4070
Published: 2006-08-10
Description: Format string vulnerability in Imendio Planner 0.13 allows user-assisted attackers to execute arbitrary code via format string specifiers in a filename.
CVSS Score: 5.1 (MEDIUM)
References: http://securityreason.com/securityalert/1361; http://www.securityfocus.com/archive/1/442439/100/0/threaded; http://www.securityfocus.com/bid/19307
CVE: CVE-2006-4071
Published: 2006-08-10
Description: Sign extension vulnerability in the createBrushIndirect function in the GDI library (gdi32.dll) in Microsoft Windows XP, Server 2003, and possibly other versions, allows user-assisted attackers to cause a denial of service (application crash) via a crafted WMF file.
CVSS Score: 2.6 (LOW)
References: http://determina.blogspot.com/2007/01/whats-wrong-with-wmf.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048530.html; http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048547.html
CVE: CVE-2006-4072
Published: 2006-08-11
Description: Multiple SQL injection vulnerabilities in Club-Nuke [XP] 2.0 LCID 2048 allow remote attackers to execute arbitrary SQL commands via the (1) haber_id parameter to haber_detay.asp, and allow remote authenticated users to execute arbitrary SQL commands via the (2) menu_id parameter to menu.asp.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/21431; http://www.securityfocus.com/bid/19442; http://www.vupen.com/english/advisories/2006/3228
CVE: CVE-2006-4073
Published: 2006-08-11
Description: Multiple PHP remote file inclusion vulnerabilities in Fabian Hainz phpCC Beta 4.2 allow remote attackers to execute arbitrary PHP code via a URL in the base_dir parameter to (1) login.php, (2) reactivate.php, or (3) register.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/442428/100/0/threaded; http://www.securityfocus.com/bid/19376; http://www.solpotcrew.org/adv/solpot-adv-05.txt
CVE: CVE-2006-4074
Published: 2006-08-11
Description: PHP remote file inclusion vulnerability in lib/tpl/default/main.php in the JD-Wiki Component (com_jd-wiki) 1.0.2 and earlier for Joomla!, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21389; http://www.joomladeveloping.org/component/option%2Ccom_jd-wp/Itemid%2C29/p%2C33/; http://www.securityfocus.com/bid/19373
CVE: CVE-2006-4075
Published: 2006-08-11
Description: Multiple PHP remote file inclusion vulnerabilities in Wim Fleischhauer docpile: wim's edition (docpile:we) 0.2.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the INIT_PATH parameter to (1) lib/folder.class.php, (2) lib/email.inc.php, (3) lib/document.class.php or (4) lib/auth.inc.php.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21412; http://securityreason.com/securityalert/1367; http://securitytracker.com/id?1016669