deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-1100
Published: 2006-03-09
Description: Buffer overflow in the sgetstr function in shared/cube.h in Sauerbraten 2006_02_28 and earlier, as derived from the Cube engine, allows remote attackers to execute arbitrary code via long streams of input data.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/evilcube-adv.txt; http://cvs.sourceforge.net/viewcvs.py/sauerbraten/sauerbraten/src/shared/cube.h?r1=1.7&r2=1.8; http://secunia.com/advisories/19110
CVE: CVE-2006-1101
Published: 2006-03-09
Description: The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28, as derived from the Cube engine, allow remote attackers to cause a denial of service (segmentation fault) via long streams of input data that trigger an out-of-bounds read, as demonstrated using SV_EXT tag data in the Cube engine, which is not properly handled by getint.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/evilcube-adv.txt; http://secunia.com/advisories/19110; http://secunia.com/advisories/19111
CVE: CVE-2006-1102
Published: 2006-03-09
Description: Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (client exit) by forcing the server to change to a map (ogz) file whose name contains ".." sequences and has a certain length that prevents the addition of the ".ogz" extension.
CVSS Score: 5.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/evilcube-adv.txt; http://secunia.com/advisories/19110; http://secunia.com/advisories/19111
CVE: CVE-2006-1103
Published: 2006-03-09
Description: engine/server.cpp in Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (segmentation fault) via a client that does not completely join the game and times out, which results in a null pointer dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/550; http://www.securityfocus.com/archive/1/426865/100/0/threaded; http://www.securityfocus.com/bid/16986
CVE: CVE-2006-1104
Published: 2006-03-09
Description: Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the showimage parameter in index.php; and the (2) USER_AGENT, (3) HTTP_REFERER, and (4) HTTP_HOST HTTP header fields as used in the book_vistor function in includes/functions.php.  NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
CVSS Score: 7.5 (HIGH)
References: http://forum.pixelpost.org/showthread.php?t=3535; http://www.neosecurityteam.net/index.php?action=advisories&id=19; http://www.securityfocus.com/archive/1/426764/100/0/threaded
CVE: CVE-2006-1105
Published: 2006-03-09
Description: Pixelpost 1.5 beta 1 and earlier allows remote attackers to obtain configuration information via a direct request to includes/phpinfo.php, which calls the phpinfo function.  NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
CVSS Score: 5.0 (MEDIUM)
References: http://forum.pixelpost.org/showthread.php?t=3535; http://www.neosecurityteam.net/index.php?action=advisories&id=19; http://www.securityfocus.com/archive/1/426764/100/0/threaded
CVE: CVE-2006-1106
Published: 2006-03-09
Description: Cross-site scripting (XSS) vulnerability in Pixelpost 1.5 beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) message, (2) name, (3) url, and (4) email parameters when commenting on a post.  NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
CVSS Score: 4.3 (MEDIUM)
References: http://forum.pixelpost.org/showthread.php?t=3535; http://www.neosecurityteam.net/index.php?action=advisories&id=19; http://www.securityfocus.com/archive/1/426764/100/0/threaded
CVE: CVE-2006-1107
Published: 2006-03-09
Description: Cross-site scripting (XSS) vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the nick parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/93/summary.html; http://nmdeluxe.com/index.php; http://secunia.com/advisories/19117
CVE: CVE-2006-1108
Published: 2006-03-09
Description: SQL injection vulnerability in news.php in NMDeluxe before 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/93/summary.html; http://nmdeluxe.com/index.php; http://secunia.com/advisories/19117
CVE: CVE-2006-1109
Published: 2006-03-09
Description: SQL injection vulnerability in index.asp in Total Ecommerce 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: it is not clear whether this report is associated with a specific product.  If not, then it should not be included in CVE.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19103; http://securityreason.com/securityalert/530; http://www.nukedx.com/?viewdoc=18
CVE: CVE-2006-1110
Published: 2006-03-09
Description: Cross-site scripting (XSS) vulnerability in Aztek Forum 4.0 allows remote attackers to inject arbitrary web script or HTML via the message body in a new message.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19096; http://www.osvdb.org/23610; http://www.securityfocus.com/archive/1/426650/100/0/threaded
CVE: CVE-2006-1111
Published: 2006-03-09
Description: Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "*/*" in the msg parameter to index.php, which reveals usernames and passwords in a MySQL error message, possibly due to a forced SQL error or SQL injection.
CVSS Score: 7.5 (HIGH)
References: http://www.osvdb.org/23611; http://www.securityfocus.com/archive/1/426650/100/0/threaded; http://www.securityfocus.com/bid/16938
CVE: CVE-2006-1112
Published: 2006-03-09
Description: Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a long login value in a register form, which displays the installation path in a MySQL error message.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/539; http://www.osvdb.org/23612; http://www.securityfocus.com/archive/1/426650/100/0/threaded
CVE: CVE-2006-1113
Published: 2006-03-09
Description: SQL injection vulnerability in podcast.php in Loudblog before 0.42 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://loudblog.de/forum/viewtopic.php?id=590; http://secunia.com/advisories/19172; http://www.securityfocus.com/archive/1/426973/100/0/threaded
CVE: CVE-2006-1114
Published: 2006-03-09
Description: Multiple directory traversal vulnerabilities in Loudblog before 0.42 allow remote attackers to read or include arbitrary files via a .. (dot dot) and trailing %00 (NULL) byte in the (1) template and (2) page parameters in (a) index.php, and the (3) language parameter in (b) inc/backend_settings.php.
CVSS Score: 6.4 (MEDIUM)
References: http://loudblog.de/forum/viewtopic.php?id=590; http://secunia.com/advisories/19172; http://www.securityfocus.com/archive/1/426973/100/0/threaded
CVE: CVE-2006-1115
Published: 2006-03-09
Description: nCipher HSM before 2.22.6, when generating a Diffie-Hellman public/private key pair without any specified DiscreteLogGroup parameters, chooses random parameters that could allow an attacker to crack the private key in significantly less time than a brute force attack.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19137; http://securitytracker.com/id?1015719; http://www.ncipher.com/resources/95/sa12_insecure_generation_of_diffiehellman_keys
CVE: CVE-2006-1116
Published: 2006-03-09
Description: The CBC-MAC integrity functions in the nCipher nCore API before 2.18 transmit the initialization vector IV as part of a message when the implementation uses a non-zero IV, which allows remote attackers to bypass integrity checks and modify messages without being detected.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19137; http://securitytracker.com/id?1015718; http://www.ncipher.com/resources/96/sa13_cbcmac_iv_misleading_programming_interface
CVE: CVE-2006-1117
Published: 2006-03-09
Description: nCipher firmware before V10, as used by (1) nShield, (2) nForce, (3) netHSM, (4) payShield, (5) SecureDB, (6) DSE200 Document Sealing Engine, (7) Time Source Master Clock (TSMC), and possibly other products, contains certain options that were only intended for testing and not production, which might allow remote attackers to obtain information about encryption keys and crack those keys with less effort than brute force.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19137; http://securitytracker.com/id?1015718; http://www.ncipher.com/resources/97/sa14_presence_of_flaws_in_firmware_security
CVE: CVE-2006-1118
Published: 2006-03-09
Description: SQL injection vulnerability in bmail before Aardvark PR9.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving GBK character sets.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19147; http://sourceforge.net/project/shownotes.php?group_id=144412&release_id=399256; http://www.vupen.com/english/advisories/2006/0863
CVE: CVE-2006-0743
Published: 2006-03-09
Description: Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-134
References: http://issues.apache.org/jira/browse/LOG4NET-67; http://secunia.com/advisories/19241; http://secunia.com/advisories/22932
CVE: CVE-2006-1119
Published: 2006-03-09
Description: fantastico in Cpanel does not properly handle when it has insufficient permissions to perform certain file operations, which allows remote authenticated users to obtain the full pathname, which is leaked in a PHP error message.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/426957/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/25277; http://www.securityfocus.com/archive/1/426957/100/0/threaded
CVE: CVE-2006-1120
Published: 2006-03-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 6.1.1 and earlier, with register_globals enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) its_url parameter in the documents page and (2) url parameter in the send_write page of (a) index.php; (3) subject, and (4) images parameters to (b) calendar.php; (5) bid, (6) replying_msg, (7) subject, (8) body, and (9) mid parameters to (c) forums.php; (10) subject and (11) message parameters to (d) inbox.php; (12) subject_color and (13) email parameters to (e) lostpassword.php; and the (14) c_name, (15) content_inicial, and (16) cid parameters to (f) mycontents.php.  NOTE: the calendar.php/day vector is already subsumed by CVE-2006-0220, and the calendar.php/month, calendar.php/year, and search.php/q parameters for calendar.php are already subsumed by CVE-2004-2511.
CVSS Score: 2.6 (LOW)
References: http://securityreason.com/securityalert/392; http://www.osvdb.org/23976; http://www.osvdb.org/23977
CVE: CVE-2006-1121
Published: 2006-03-09
Description: Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the query string to index.php.
CVSS Score: 6.8 (MEDIUM)
References: http://kapda.ir/advisory-277.html; http://securityreason.com/securityalert/531; http://securitytracker.com/id?1015726
CVE: CVE-2006-1122
Published: 2006-03-09
Description: Cross-site scripting (XSS) vulnerability in Default.asp in D2KBlog 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/19177; http://securityreason.com/securityalert/559; http://www.osvdb.org/23771
CVE: CVE-2006-1123
Published: 2006-03-09
Description: SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter in a cookie.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/19177; http://securityreason.com/securityalert/559; http://www.osvdb.org/23770
CVE: CVE-2006-1124
Published: 2006-03-09
Description: Buffer overflow in RevilloC MailServer and Proxy 1.21 allows remote attackers to execute arbitrary code via a long USER command.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0910.html; http://secunia.com/advisories/19119; http://securitytracker.com/id?1015739
CVE: CVE-2006-1125
Published: 2006-03-09
Description: Grisoft AVG Free 7.1, and other versions including 7.0.308, sets Everyone/Full Control permissions for certain update files including (1) upd_vers.cfg, (2) incavi.avm, and (3) unspecified drivers, which might allow local users to gain privileges.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0631.html; http://secunia.com/advisories/19118; http://securitytracker.com/id?1015728
CVE: CVE-2006-1126
Published: 2006-03-09
Description: Gallery 2 up to 2.0.2 allows remote attackers to spoof their IP address via a modified X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is checked by Gallery before other more reliable sources of IP address information, such as REMOTE_ADDR.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0621.html; http://gallery.menalto.com/gallery_2.0.3_released; http://secunia.com/advisories/19104
CVE: CVE-2006-1127
Published: 2006-03-09
Description: Cross-site scripting (XSS) vulnerability in Gallery 2 up to 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For (X_FORWARDED_FOR) HTTP header, which is not properly handled when adding a comment to an album.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0621.html; http://gallery.menalto.com/gallery_2.0.3_released; http://secunia.com/advisories/19104
CVE: CVE-2006-1128
Published: 2006-03-09
Description: Directory traversal vulnerability in the session handling class (GallerySession.class) in Gallery 2 up to 2.0.2 allows remote attackers to access and delete files by specifying the session in a cookie, which is used in constructing file paths before the session value is sanitized.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0621.html; http://gallery.menalto.com/gallery_2.0.3_released; http://secunia.com/advisories/19104
CVE: CVE-2006-0040
Published: 2006-03-10
Description: GNOME Evolution 2.4.2.1 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a text e-mail with a large number of URLs, possibly due to unknown problems in gtkhtml.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19094; http://www.securityfocus.com/archive/1/426452/100/0/threaded; http://www.securityfocus.com/bid/16899
CVE: CVE-2006-0667
Published: 2006-03-10
Description: lscfg in IBM AIX 5.2 and 5.3 allows local users to modify arbitrary files via a symlink attack.
CVSS Score: 4.6 (MEDIUM)
References: http://securitytracker.com/id?1015622; http://www-1.ibm.com/support/docview.wss?uid=isg1IY77624; http://www-1.ibm.com/support/docview.wss?uid=isg1IY77638
CVE: CVE-2006-1129
Published: 2006-03-10
Description: SQL injection vulnerability in config.php in EKINboard 1.0.3 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username cookie.
CVSS Score: 7.5 (HIGH)
References: http://evuln.com/vulns/88/summary.html; http://secunia.com/advisories/19045; http://www.ekinboard.com/forums/v1/viewtopic.php?id=469
CVE: CVE-2006-1130
Published: 2006-03-10
Description: Cross-site scripting (XSS) vulnerability in EKINboard 1.0.3 allows remote attackers to inject arbitrary web script or HTML via a Javascript URI in a BBCode img tag.
CVSS Score: 4.3 (MEDIUM)
References: http://evuln.com/vulns/88/summary.html; http://secunia.com/advisories/19045; http://securityreason.com/securityalert/558
CVE: CVE-2006-1131
Published: 2006-03-10
Description: Cross-site scripting (XSS) vulnerability in read.php in bitweaver CMS 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the comment_title parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://kiki91.altervista.org/exploit/bitweaver_1.2.1_XSS.txt; http://secunia.com/advisories/19101; http://www.securityfocus.com/bid/16973
CVE: CVE-2006-1132
Published: 2006-03-10
Description: SQL injection vulnerability in show.php in vbzoom 1.11 allow remote attackers to execute arbitrary SQL commands via the MainID parameter. NOTE: the SubjectID vector is already covered by CVE-2005-4729.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/552; http://www.securityfocus.com/archive/1/426874/100/0/threaded; http://www.securityfocus.com/bid/16955
CVE: CVE-2006-1133
Published: 2006-03-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to (1) comment.php or (2) contact.php.  NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/552; http://www.osvdb.org/23812; http://www.osvdb.org/23813
CVE: CVE-2006-1134
Published: 2006-03-10
Description: SQL injection vulnerability in CyBoards PHP Lite 1.25, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the parent parameter to (1) post.php and possibly (2) process_post.php.
CVSS Score: 5.1 (MEDIUM)
References: http://evuln.com/vulns/91/description.html; http://secunia.com/advisories/19135; http://securityreason.com/securityalert/582
CVE: CVE-2006-1135
Published: 2006-03-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in sBlog 0.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to search.php or (2) username parameter to comments_do.php.
CVSS Score: 4.3 (MEDIUM)
References: http://kiki91.altervista.org/exploit/sBlog_0.72_xss.txt; http://secunia.com/advisories/19151; http://www.osvdb.org/23759
CVE: CVE-2006-1136
Published: 2006-03-10
Description: Buffer overflow in the PostScript file interpreter code for Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allows attackers to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19146; http://securitytracker.com/id?1015738; http://www.osvdb.org/23724
CVE: CVE-2006-1137
Published: 2006-03-10
Description: Multiple unspecified vulnerabilities in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allow remote attackers to cause an unspecified denial of service via a crafted PostScript file that will (1) "navigate through the directory" or (2) a "file sent to expose TCP/IP ports".
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19146; http://securitytracker.com/id?1015738; http://www.osvdb.org/23725
CVE: CVE-2006-1138
Published: 2006-03-10
Description: Unspecified vulnerability in the web server code in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, allows remote attackers to cause a denial of service (memory corruption) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/19146; http://securitytracker.com/id?1015738; http://www.osvdb.org/23727
CVE: CVE-2006-1139
Published: 2006-03-10
Description: Unspecified vulnerability in the ESS/ Network Controller in Xerox CopyCentre and Xerox WorkCentre Pro, running software 1.001.02.073 or earlier, or 1.001.02.074 before 1.001.02.715, causes the Immediate Image Overwrite feature to fail after a power loss, which could leave data exposed to attack.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/19146; http://securitytracker.com/id?1015738; http://www.osvdb.org/23728
CVE: CVE-2006-1140
Published: 2006-03-10
Description: SQL injection vulnerability in rss.php in RedBLoG 0.5 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19181; http://www.securityfocus.com/bid/17041; http://www.vupen.com/english/advisories/2006/0894
CVE: CVE-2006-1141
Published: 2006-03-10
Description: Buffer overflow in qmailadmin.c in QmailAdmin before 1.2.10 allows remote attackers to execute arbitrary code via a long PATH_INFO environment variable.
CVSS Score: 7.5 (HIGH)
References: http://cvs.sourceforge.net/viewcvs.py/qmailadmin/qmailadmin/qmailadmin.c?r1=1.6.2.10&r2=1.6.2.11; http://secunia.com/advisories/19262; http://secunia.com/advisories/23019
CVE: CVE-2006-1142
Published: 2006-03-10
Description: Unspecified vulnerability in Ravenous Web Server before 0.7.1 allows remote attackers to access arbitrary rvplg files, with unknown impact.
CVSS Score: 5.0 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?group_id=131871&release_id=399092; http://www.osvdb.org/23706; http://www.securityfocus.com/bid/17013
CVE: CVE-2006-1143
Published: 2006-03-10
Description: Cross-site scripting (XSS) vulnerability in FTPoed Blog Engine 1.1 allows remote attackers to inject arbitrary web script or HTML via the comment_body parameter, as used by the comment field, when posting a comment.
CVSS Score: 4.3 (MEDIUM)
References: http://securitytracker.com/id?1015725; http://www.securityfocus.com/archive/1/426828/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/25138
CVE: CVE-2006-1144
Published: 2006-03-10
Description: Cross-site scripting (XSS) vulnerability in HitHost 1.0.0 allows remote attackers to inject arbitrary web script or HTML via (1) the user parameter in deleteuser.php and (2) the hits parameter in viewuser.php.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19155; http://www.osvdb.org/23757; http://www.osvdb.org/23758
CVE: CVE-2006-1145
Published: 2006-03-10
Description: Format string vulnerability in the safe_cprintf function in acebot_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code via unspecified vectors when the server sends crafted messages to the clients.
CVSS Score: 6.5 (MEDIUM)
References: http://aluigi.altervista.org/adv/aa2k6x-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2006-03/0147.html; http://secunia.com/advisories/19144
CVE: CVE-2006-1146
Published: 2006-03-10
Description: Stack-based buffer overflow in the Cmd_Say_f function in g_cmds.c in Alien Arena 2006 Gold Edition 5.00 allows remote attackers (possibly authenticated) to execute arbitrary code by sending a long message to the server.
CVSS Score: 6.5 (MEDIUM)
References: http://aluigi.altervista.org/adv/aa2k6x-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2006-03/0147.html; http://secunia.com/advisories/19144
CVE: CVE-2006-1147
Published: 2006-03-10
Description: The Com_sprintf function in q_shared.c in Alien Arena 2006 Gold Edition 5.00 does not properly NULL terminate certain long strings, which allows remote attackers (possibly authenticated) to cause a denial of service (application crash) via a long skin, weapon, or model name.
CVSS Score: 4.0 (MEDIUM)
References: http://aluigi.altervista.org/adv/aa2k6x-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2006-03/0147.html; http://secunia.com/advisories/19144