deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-3113
Published: 2006-07-27
Description: Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via simultaneous XPCOM events, which causes a timer object to be deleted in a way that triggers memory corruption.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-3801
Published: 2006-07-27
Description: Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 does not properly clear a JavaScript reference to a frame or window, which leaves a pointer to a deleted object that allows remote attackers to execute arbitrary native code.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-3802
Published: 2006-07-27
Description: Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
CVSS Score: 5.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-3805
Published: 2006-07-27
Description: The Javascript engine in Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code via vectors involving garbage collection that causes deletion of a temporary object that is still being used.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-3808
Published: 2006-07-27
Description: Mozilla Firefox before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote Proxy AutoConfig (PAC) servers to execute code with elevated privileges via a PAC script that sets the FindProxyForURL function to an eval method on a privileged object.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-3809
Published: 2006-07-27
Description: Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows scripts with the UniversalBrowserRead privilege to gain UniversalXPConnect privileges and possibly execute code or obtain sensitive data by reading into a privileged context.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-3810
Published: 2006-07-27
Description: Cross-site scripting (XSS) vulnerability in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the XPCNativeWrapper(window).Function construct.
CVSS Score: 6.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-3811
Published: 2006-07-27
Description: Multiple vulnerabilities in Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Javascript that leads to memory corruption, including (1) nsListControlFrame::FireMenuItemActiveEvent, (2) buffer overflows in the string class in out-of-memory conditions, (3) table row and column groups, (4) "anonymous box selectors outside of UA stylesheets," (5) stale references to "removed nodes," and (6) running the crypto.generateCRMFRequest callback on deleted context.
CVSS Score: 7.5 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-2933
Published: 2006-07-27
Description: kdesktop_lock in kdebase before 3.1.3-5.11 for KDE in Red Hat Enterprise Linux (RHEL) 3 does not properly terminate, which can prevent the screensaver from activating or prevent users from manually locking the desktop.
CVSS Score: 4.6 (MEDIUM)
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=177755; http://secunia.com/advisories/21203; http://securitytracker.com/id?1016571
CVE: CVE-2006-3902
Published: 2006-07-27
Description: Cross-site scripting (XSS) vulnerability in index.php in phpFaber TopSites 2.0.9 allows remote attackers to inject arbitrary web script or HTML via the i_cat parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21141; http://www.vupen.com/english/advisories/2006/2913; http://secunia.com/advisories/21141
CVE: CVE-2006-3903
Published: 2006-07-27
Description: CRLF injection vulnerability in (1) index.php and (2) admin.php in myWebland MyBloggie 2.1.3 allows remote attackers to hijack sessions and conduct cross-site scripting (XSS) attacks via a cookie.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046094.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2460&w=2; http://www.osvdb.org/displayvuln.php?osvdb_id=26557
CVE: CVE-2006-3904
Published: 2006-07-27
Description: SQL injection vulnerability in manager/index.php in Etomite CMS 0.6.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://retrogod.altervista.org/etomite_061_sql.html; http://secunia.com/advisories/21167; http://securitytracker.com/id?1016594
CVE: CVE-2006-3905
Published: 2006-07-27
Description: SQL injection vulnerability in Webland MyBloggie 2.1.3 allows remote attackers to execute arbitrary SQL commands via the (1) post_id parameter in index.php and (2) search function.
CVSS Score: 7.5 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046094.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2460&w=2; http://www.h4cky0u.org/advisories/HYSA-2006-008-mybloggie.txt
CVE: CVE-2006-3906
Published: 2006-07-27
Description: Internet Key Exchange (IKE) version 1 protocol, as implemented on Cisco IOS, VPN 3000 Concentrators, and PIX firewalls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of IKE Phase-1 packets that exceed the session expiration rate. NOTE: it has been argued that this is due to a design weakness of the IKE version 1 protocol, in which case other vendors and implementations would also be affected.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0531.html; http://securityreason.com/securityalert/1293; http://securitytracker.com/id?1016582
CVE: CVE-2006-3907
Published: 2006-07-27
Description: Siemens SpeedStream 2624 allows remote attackers to cause a denial of service (device hang) by sending a crafted packet to the web administrative interface.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21195; http://securityreason.com/securityalert/1292; http://securitytracker.com/id?1016578
CVE: CVE-2006-3908
Published: 2006-07-27
Description: Format string vulnerability in the flush_output function in ConsoleStreambuf.cpp in Game Network Engine (GNE) 0.70 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute code via format string specifiers in unspecified vectors involving output to the gout console.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/gnefs-adv.txt; http://gnelib.cvs.sourceforge.net/gnelib/gnelib/src/ConsoleStreambuf.cpp?r1=1.8&r2=1.9&sortby=date; http://www.securityfocus.com/bid/19154
CVE: CVE-2006-3909
Published: 2006-07-27
Description: Cross-site scripting (XSS) vulnerability in calendar.php in WWWthreads allows remote attackers to inject arbitrary web script or HTML via the week parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/21221; http://www.aria-security.net/advisory/wwwthreads.txt; http://www.osvdb.org/27542
CVE: CVE-2006-3350
Published: 2006-07-28
Description: Stack-based buffer overflow in AutoVue SolidModel Professional Desktop Edition 19.1 Build 5993 allows user-assisted remote attackers to execute arbitrary code via a long filename in a (1) ARJ, (2) RAR, or (3) ZIP archive.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/20852; http://secunia.com/secunia_research/2006-56/advisory/; http://www.osvdb.org/27516
CVE: CVE-2006-3910
Published: 2006-07-28
Description: Internet Explorer 6 on Windows XP SP2, when Outlook is installed, allows remote attackers to cause a denial of service (crash) by calling the NewDefaultItem function of an OVCtl (OVCtl.OVCtl.1) ActiveX object, which triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-20-ovctl-newdefaultitem.html; http://www.osvdb.org/27112; http://www.securityfocus.com/bid/19079
CVE: CVE-2006-3911
Published: 2006-07-28
Description: PHP remote file inclusion vulnerability in OSI Codes PHP Live! 3.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the css_path parameter in (1) help.php and (2) setup/header.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21158; http://securityreason.com/securityalert/1297; http://securitytracker.com/id?1016581
CVE: CVE-2006-3912
Published: 2006-07-28
Description: Stack-based buffer overflow in the SFX module in WinRAR before 3.60 beta 8 has unspecified vectors and impact.
CVSS Score: 2.1 (LOW)
CWE: CWE-119
References: http://www.osvdb.org/27031; http://www.rarlabs.com/rarnew.htm; https://www.exploit-db.com/exploits/1984
CVE: CVE-2006-3913
Published: 2006-07-28
Description: Buffer overflow in Freeciv 2.1.0-beta1 and earlier, and SVN 15 Jul 2006 and earlier, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) negative chunk_length or a (2) large chunk->offset value in a PACKET_PLAYER_ATTRIBUTE_CHUNK packet in the generic_handle_player_attribute_chunk function in common/packets.c, and (3) a large packet->length value in the handle_unit_orders function in server/unithand.c.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/freecivx-adv.txt; http://secunia.com/advisories/21171; http://secunia.com/advisories/21254
CVE: CVE-2006-3914
Published: 2006-07-28
Description: Cross-site scripting (XSS) vulnerability in Blackboard Academic Suite 6.2.3.23 allows remote authenticated users to inject arbitrary HTML or web script by bypassing client-side validation through disabling JavaScript when submitting an essay response, which has no server-side validation before being viewed via "View Attempt Details" in the Gradebook.
CVSS Score: 6.0 (MEDIUM)
References: http://securityreason.com/securityalert/1295; http://securitytracker.com/id?1016556; http://www.securityfocus.com/archive/1/440888/100/0/threaded
CVE: CVE-2006-3915
Published: 2006-07-28
Description: Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by iterating over any native function, as demonstrated with the window.alert function, which triggers a null dereference.
CVSS Score: 5.0 (MEDIUM)
References: http://browserfun.blogspot.com/2006/07/mobb-25-native-function-iterator.html; http://www.osvdb.org/27373; http://www.securityfocus.com/bid/19140
CVE: CVE-2006-3916
Published: 2006-07-28
Description: Cross-site scripting (XSS) vulnerability in snews.php in sNews (aka Solucija News) 1.4 allows remote attackers to inject arbitrary web script or HTML via the search_query parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21189; http://security-net.biz/adv/D25706a.txt; http://www.osvdb.org/27481
CVE: CVE-2006-3917
Published: 2006-07-28
Description: PHP remote file inclusion vulnerability in inc/gabarits.php in R. Corson PHP Forge 3 beta 2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cfg_racine parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/19139; http://www.vupen.com/english/advisories/2006/2938; https://exchange.xforce.ibmcloud.com/vulnerabilities/27919
CVE: CVE-2006-3918
Published: 2006-07-28
Description: http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P; http://archives.neohapsis.com/archives/bugtraq/2006-05/0151.html; http://archives.neohapsis.com/archives/bugtraq/2006-07/0425.html
CVE: CVE-2006-3919
Published: 2006-07-28
Description: SQL injection vulnerability in index.php in SD Studio CMS allows remote attackers to execute arbitrary SQL commands via the (1) news_id, (2) tid, and (3) page_id parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21207; http://security-net.biz/adv/D24706a.txt; http://www.securityfocus.com/bid/19173
CVE: CVE-2006-3747
Published: 2006-07-28
Description: Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
CVSS Score: 7.6 (HIGH)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=307562; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01118771; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01428449
CVE: CVE-2006-3746
Published: 2006-07-28
Description: Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.
CVSS Score: 5.0 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P; http://bugs.debian.org/cgi-bin/bugreport.cgi/gnupg.CVE-2006-3746.diff?bug=381204%3Bmsg=15%3Batt=1; http://issues.rpath.com/browse/RPL-560
CVE: CVE-2006-3675
Published: 2006-07-28
Description: Password Safe 2.11, 2.16 and 3.0BETA1 does not respect the configuration settings for locking the password database when certain dialogue windows are open, which might allow attackers with physical access to obtain the database contents.
CVSS Score: 2.1 (LOW)
References: http://securityreason.com/securityalert/1308; http://securitytracker.com/id?1016565; http://www.securityfocus.com/archive/1/441040/100/0/threaded
CVE: CVE-2006-3920
Published: 2006-07-28
Description: The TCP implementation in Sun Solaris 8, 9, and 10 before 20060726 allows remote attackers to cause a denial of service (resource exhaustion) via a TCP packet with an incorrect sequence number, which triggers an ACK storm.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21226; http://secunia.com/advisories/22425; http://securitytracker.com/id?1016589
CVE: CVE-2006-3768
Published: 2006-07-28
Description: Integer underflow in filecpnt.exe in FileCOPA FTP Server 1.01 before 2006-07-21 allow remote authenticated users to execute arbitrary code via a long argument to the (1) CWD, (2) DELE, (3) MDTM, and (4) MKD commands, which triggers a stack-based buffer overflow.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/21097; http://secunia.com/secunia_research/2006-55/advisory/; http://securityreason.com/securityalert/1300
CVE: CVE-2006-3921
Published: 2006-07-28
Description: Sun Java System Application Server (SJSAS) 7 through 8.1 and Web Server (SJSWS) 6.0 and 6.1 allows remote authenticated users to read files outside of the "document root directory" via a direct request using a UTF-8 encoded URI.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/21251; http://secunia.com/advisories/22425; http://securitytracker.com/id?1016596
CVE: CVE-2006-3922
Published: 2006-07-28
Description: PHP remote file inclusion vulnerability in mod_membre/inscription.php in PortailPHP 1.7 allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21224; http://securityreason.com/securityalert/1310; http://www.securityfocus.com/archive/1/441468
CVE: CVE-2006-3923
Published: 2006-07-28
Description: Cross-site scripting (XSS) vulnerability in add.php in Fire-Mouse Toplist 1.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the Seitenname parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/21173; http://securityreason.com/securityalert/1299; http://www.majorsecurity.de/advisory/major_rls24.txt
CVE: CVE-2006-3924
Published: 2006-07-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Dokeos before 1.6.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/21239; http://www.dokeos.com/news.php#145; http://www.osvdb.org/27586
CVE: CVE-2006-3925
Published: 2006-07-28
Description: Stack-based buffer overflow in ITIRecorder.MicRecorder ActiveX control in iarecord.dll in InterActual Player before 2.6 allows remote attackers to execute arbitrary code via a long argument to the Files method.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/20845; http://www.securityfocus.com/bid/19205; http://www.vupen.com/english/advisories/2006/3016
CVE: CVE-2006-3812
Published: 2006-07-29
Description: Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to reference remote files and possibly load chrome: URLs by tricking the user into copying or dragging links.
CVSS Score: 2.6 (LOW)
References: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc; http://rhn.redhat.com/errata/RHSA-2006-0609.html; http://secunia.com/advisories/19873
CVE: CVE-2006-1178
Published: 2006-07-29
Description: Tamarack MMSd before 7.992 allows remote attackers to cause a denial of service (crash) via malformed RFC1006 (OSI over TCP/IP) packets.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1016734; http://www.kb.cert.org/vuls/id/372878; http://www.kb.cert.org/vuls/id/JGEI-6RZPUT
CVE: CVE-2006-2481
Published: 2006-07-31
Description: VMware ESX Server 2.0.x before 2.0.2 and 2.x before 2.5.2 patch 4 stores authentication credentials in base 64 encoded format in the vmware.mui.kid and vmware.mui.sid cookies, which allows attackers to gain privileges by obtaining the cookies using attacks such as cross-site scripting (CVE-2005-3619).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://kb.vmware.com/kb/2118366; http://secunia.com/advisories/21230; http://www.corsaire.com/advisories/c060512-001.txt
CVE: CVE-2006-3120
Published: 2006-07-31
Description: Format string vulnerability in Brian Wotring Osiris before 4.2.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified attack vectors related to the logging functions.
CVSS Score: 7.5 (HIGH)
References: http://osiris.shmoo.com/ChangeLog; http://osiris.shmoo.com/download.html; http://secunia.com/advisories/21257
CVE: CVE-2006-3926
Published: 2006-07-31
Description: Multiple SQL injection vulnerabilities in PhpProBid 5.24 allow remote attackers to execute arbitrary SQL commands via the (1) view or (2) start parameters to (a) viewfeedback.php or the (3) orderType parameter to (b) categories.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0474.html; http://secunia.com/advisories/21201; http://securityreason.com/securityalert/1298
CVE: CVE-2006-3927
Published: 2006-07-31
Description: Cross-site scripting (XSS) vulnerability in auctionsearch.php in PhpProBid 5.24 allows remote attackers to inject arbitrary web script or HTML via the advsrc parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-07/0474.html; http://secunia.com/advisories/21201; http://securityreason.com/securityalert/1298
CVE: CVE-2006-3928
Published: 2006-07-31
Description: PHP remote file inclusion vulnerability in index.php in WMNews 0.2a and earlier allows remote attackers to execute arbitrary PHP code via a URL in the base_datapath parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21234; http://www.osvdb.org/27547; http://www.securityfocus.com/bid/19187
CVE: CVE-2006-3929
Published: 2006-07-31
Description: Cross-site scripting (XSS) vulnerability in the Forms/rpSysAdmin script on the Zyxel Prestige 660H-61 ADSL Router running firmware 3.40(PT.0)b32 allows remote attackers to inject arbitrary web script or HTML via hex-encoded values in the a parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21225; http://securityreason.com/securityalert/1301; http://securitytracker.com/id?1016598
CVE: CVE-2006-3930
Published: 2006-07-31
Description: PHP remote file inclusion vulnerability in admin.a6mambohelpdesk.php in a6mambohelpdesk Mambo Component 18RC1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21227; http://securityreason.com/securityalert/1309; http://www.osvdb.org/27654
CVE: CVE-2006-3931
Published: 2006-07-31
Description: Buffer overflow in the daemon function in midirecord.cc in Tuomas Airaksinen Midirecord 2.0 allows local users to execute arbitrary code via a long command line argument (filename).  NOTE: This may not be a vulnerability if Midirecord is not installed setuid.
CVSS Score: 4.6 (MEDIUM)
References: http://advisories.echo.or.id/adv/adv41-theday-2006.txt; http://securityreason.com/securityalert/1303; http://www.securityfocus.com/archive/1/441204/100/0/threaded
CVE: CVE-2006-3932
Published: 2006-07-31
Description: SQL injection vulnerability in links.php in Gonafish LinksCaffe 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21212; http://www.vupen.com/english/advisories/2006/2983; https://exchange.xforce.ibmcloud.com/vulnerabilities/27961
CVE: CVE-2006-3933
Published: 2006-07-31
Description: Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.2.2 allows remote authenticated users to inject arbitrary web script or HTML via the message body.
CVSS Score: 3.5 (LOW)
References: http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt; http://secunia.com/advisories/21193; http://securityreason.com/securityalert/1302