deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6605
Published: 2006-12-19
Description: Stack-based buffer overflow in the POP service in MailEnable Standard 1.98 and earlier; Professional 1.84, and 2.35 and earlier; and Enterprise 1.41, and 2.35 and earlier before ME-10026 allows remote attackers to execute arbitrary code via a long argument to the PASS command.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23127; http://secunia.com/secunia_research/2006-75/advisory/; http://securityreason.com/securityalert/2053
CVE: CVE-2006-6636
Published: 2006-12-19
Description: Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server (WAS) before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23386; http://secunia.com/advisories/23414; http://www-1.ibm.com/support/docview.wss?uid=swg1PK29725
CVE: CVE-2006-6637
Published: 2006-12-19
Description: The Servlet Engine and Web Container in IBM WebSphere Application Server (WAS) before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/23414; http://secunia.com/advisories/24478; http://www-1.ibm.com/support/docview.wss?uid=swg21243541
CVE: CVE-2006-6638
Published: 2006-12-19
Description: IBM DB2 8.1 before FixPak 14 allows remote attackers to cause a denial of service via a crafted SQLJRA packet, which causes a NULL pointer dereference in the sqle_db2ra_as_recvrequest function in DB2ENGN.DLL, a different issue than CVE-2006-4257.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23397; http://www-1.ibm.com/support/docview.wss?uid=swg1IY91847; http://www.appsecinc.com/resources/alerts/db2/2006-11-30.shtml
CVE: CVE-2006-6639
Published: 2006-12-19
Description: Multiple unspecified vulnerabilities in chetcpasswd 2.4.1 allow local users to gain privileges via unspecified vectors related to executing (1) the cp program, (2) the mail program, or (3) the program specified in the post_change configuration line.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/23024; http://www.securityfocus.com/bid/21644; http://secunia.com/advisories/23024
CVE: CVE-2006-6640
Published: 2006-12-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Omniture SiteCatalyst allow remote attackers to inject arbitrary web script or HTML via the (1) ss parameter in (a) search.asp and the (2) company and (3) username fields on (b) the web login page.  NOTE: some details were obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2048; http://securitytracker.com/id?1017392; http://www.hackerscenter.com/archive/view.asp?id=26714
CVE: CVE-2006-6641
Published: 2006-12-20
Description: Unspecified vulnerability in CA CleverPath Portal before maintenance version 4.71.001_179_060830, as used in multiple products including BrightStor Portal r11.1, CleverPath Aion BPM r10 through r10.2, eTrust Security Command Center r1 and r8, and Unicenter, does not properly handle when multiple Portal servers are started at the same time and share the same data store, which might cause a Portal user to inherit the session and credentials of a user who is on another Portal server.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23426; http://securitytracker.com/id?1017429; http://supportconnectw.ca.com/public/ca_common_docs/cpportal_secnot.asp
CVE: CVE-2006-6497
Published: 2006-12-20
Description: Multiple unspecified vulnerabilities in the layout engine for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown attack vectors.
CVSS Score: 6.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc; http://fedoranews.org/cms/node/2297; http://fedoranews.org/cms/node/2338
CVE: CVE-2006-6498
Published: 2006-12-20
Description: Multiple unspecified vulnerabilities in the JavaScript engine for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, SeaMonkey before 1.0.7, and Mozilla 1.7 and probably earlier on Solaris, allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown impact and attack vectors.
CVSS Score: 6.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc; http://fedoranews.org/cms/node/2297; http://fedoranews.org/cms/node/2338
CVE: CVE-2006-6499
Published: 2006-12-20
Description: The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins that reduce the precision.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-835
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://secunia.com/advisories/23282; http://secunia.com/advisories/23420
CVE: CVE-2006-6500
Published: 2006-12-20
Description: Heap-based buffer overflow in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by setting the CSS cursor to certain images that cause an incorrect size calculation when converting to a Windows bitmap.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://secunia.com/advisories/23282; http://secunia.com/advisories/23420
CVE: CVE-2006-6501
Published: 2006-12-20
Description: Unspecified vulnerability in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to gain privileges and install malicious code via the watch Javascript function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc; http://fedoranews.org/cms/node/2297; http://fedoranews.org/cms/node/2338
CVE: CVE-2006-6502
Published: 2006-12-20
Description: Use-after-free vulnerability in the LiveConnect bridge code for Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) via unknown vectors.
CVSS Score: 7.1 (HIGH)
References: ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc; http://fedoranews.org/cms/node/2297; http://fedoranews.org/cms/node/2338
CVE: CVE-2006-6503
Published: 2006-12-20
Description: Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to bypass cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-254
References: ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc; http://fedoranews.org/cms/node/2297; http://fedoranews.org/cms/node/2338
CVE: CVE-2006-6504
Published: 2006-12-20
Description: Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc; http://fedoranews.org/cms/node/2297; http://fedoranews.org/cms/node/2338
CVE: CVE-2006-6505
Published: 2006-12-20
Description: Multiple heap-based buffer overflows in Mozilla Thunderbird before 1.5.0.9 and SeaMonkey before 1.0.7 allow remote attackers to execute arbitrary code via (1) external message modies with long Content-Type headers or (2) long RFC2047-encoded (MIME non-ASCII) headers.
CVSS Score: 6.8 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc; http://fedoranews.org/cms/node/2297; http://fedoranews.org/cms/node/2338
CVE: CVE-2006-6506
Published: 2006-12-20
Description: The "Feed Preview" feature in Mozilla Firefox 2.0 before 2.0.0.1 sends the URL of the feed when requesting favicon.ico icons, which results in a privacy leak that might allow feed viewing services to determine browsing habits.
CVSS Score: 4.3 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://secunia.com/advisories/23282; http://secunia.com/advisories/23545
CVE: CVE-2006-6507
Published: 2006-12-20
Description: Mozilla Firefox 2.0 before 2.0.0.1 allows remote attackers to bypass Cross-Site Scripting (XSS) protection via vectors related to a Function.prototype regression error.
CVSS Score: 4.3 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742; http://secunia.com/advisories/23282; http://secunia.com/advisories/23545
CVE: CVE-2006-4814
Published: 2006-12-20
Description: The mincore function in the Linux kernel before 2.4.33.6 does not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-399
References: http://lists.vmware.com/pipermail/security-announce/2008/000023.html; http://rhn.redhat.com/errata/RHSA-2007-0014.html; http://secunia.com/advisories/23436
CVE: CVE-2006-5681
Published: 2006-12-20
Description: QuickTime for Java on Mac OS X 10.4 through 10.4.8, when used with Quartz Composer, allows remote attackers to obtain sensitive information (screen images) via a Java applet that accesses images that are being rendered by other embedded QuickTime objects.
CVSS Score: 2.6 (LOW)
References: http://docs.info.apple.com/article.html?artnum=304916; http://lists.apple.com/archives/Security-announce/2006/Dec/msg00000.html; http://secunia.com/advisories/23438
CVE: CVE-2006-6475
Published: 2006-12-20
Description: FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode with SSL enabled, allows remote attackers to cause a denial of service (refused connections) via malformed requests, which results in a mishandled exception.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/23393; http://securityreason.com/securityalert/2052; http://securitytracker.com/id?1017394
CVE: CVE-2006-6476
Published: 2006-12-20
Description: FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 (all interfaces), opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service (loss of daemon operation).
CVSS Score: 2.4 (LOW)
References: http://secunia.com/advisories/23393; http://securityreason.com/securityalert/2052; http://securitytracker.com/id?1017394
CVE: CVE-2006-6477
Published: 2006-12-20
Description: FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in daemon mode and configured to use only HTTP, allows local users to modify requests and responses between a client and an agent by hijacking an HTTP FRAgent daemon and conducting a man-in-the-middle (MITM) attack.
CVSS Score: 2.4 (LOW)
References: http://secunia.com/advisories/23393; http://securityreason.com/securityalert/2052; http://securitytracker.com/id?1017394
CVE: CVE-2006-6642
Published: 2006-12-20
Description: SQL injection vulnerability in haber.asp in Contra Haber Sistemi 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2050; http://www.securityfocus.com/archive/1/454594/100/0/threaded; http://www.securityfocus.com/bid/21626
CVE: CVE-2006-6643
Published: 2006-12-20
Description: Fightersoft Multimedia Star FTP server 1.10 allows remote attackers to cause a denial of service (crash) via multiple RETR commands with long arguments.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23320; http://www.securityfocus.com/bid/21630; http://www.vupen.com/english/advisories/2006/5042
CVE: CVE-2006-6644
Published: 2006-12-20
Description: PHP remote file inclusion vulnerability in pages/meeting_constants.php in the Meeting (mx_meeting) 1.1.2 and earlier module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23394; http://www.securityfocus.com/bid/21624; http://www.vupen.com/english/advisories/2006/5032
CVE: CVE-2006-6645
Published: 2006-12-20
Description: PHP remote file inclusion vulnerability in language/lang_english/lang_admin.php in the Web Links (mx_links) 2.05 and earlier module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21622; http://www.vupen.com/english/advisories/2006/5034; https://exchange.xforce.ibmcloud.com/vulnerabilities/30915
CVE: CVE-2006-6646
Published: 2006-12-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Drupal (1) Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0, and (2) Project 4.6.x-1.0, 4.7.x-1.0, and 4.7.x-2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, which do not use the check_plain function.
CVSS Score: 6.8 (MEDIUM)
References: http://drupal.org/node/103943; http://secunia.com/advisories/23410; http://www.securityfocus.com/bid/21643
CVE: CVE-2006-6647
Published: 2006-12-20
Description: Cross-site scripting (XSS) vulnerability in the MySite 4.7.x before 4.7.x-3.3 and 5.x before 5.x-1.3 module for Drupal allows remote attackers to inject arbitrary web script or HTML via the Title field when editing a page.  NOTE: some details were obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://drupal.org/node/103958; http://secunia.com/advisories/23405; http://www.vupen.com/english/advisories/2006/5049
CVE: CVE-2006-6648
Published: 2006-12-20
Description: PHP remote file inclusion vulnerability in main.inc.php in planetluc.com RateMe 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathtoscript parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2049; http://securitytracker.com/id?1017431; http://www.securityfocus.com/archive/1/454708/100/0/threaded
CVE: CVE-2006-6649
Published: 2006-12-20
Description: Cross-site scripting (XSS) vulnerability in display.php in HyperVM 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an encoded frm_action parameter.  NOTE: the vendor disputes this issue, but it is not certain whether the dispute is about the severity of the issue, or its existence.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23413; http://securityreason.com/securityalert/2051; http://www.aria-security.com/forum/showthread.php?p=89#post89
CVE: CVE-2006-6650
Published: 2006-12-20
Description: PHP remote file inclusion vulnerability in charts_constants.php in the Charts (mx_charts) 1.0.0 and earlier module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23369; http://www.securityfocus.com/bid/21623; http://www.vupen.com/english/advisories/2006/5033
CVE: CVE-2006-6651
Published: 2006-12-20
Description: Race condition in W29N51.SYS in the Intel 2200BG wireless driver 9.0.3.9 allows remote attackers to cause memory corruption and execute arbitrary code via a series of crafted beacon frames.  NOTE: some details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/21641.c; http://secunia.com/advisories/23338; http://www.securityfocus.com/bid/21641
CVE: CVE-2006-6652
Published: 2006-12-20
Description: Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before 20061203, and Apple Mac OS X before 2007-004, as used by the FTP daemon and tnftpd, allows remote authenticated users to execute arbitrary code via a long pathname that results from path expansion.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=305391; http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2006-027.txt.asc; http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html
CVE: CVE-2006-6653
Published: 2006-12-20
Description: The accept function in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029 allows local users to cause a denial of service (socket consumption) via an invalid (1) name or (2) namelen parameter, which may result in the socket never being closed (aka "a dangling socket").
CVSS Score: 1.7 (LOW)
CWE: CWE-20
References: ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-026.txt.asc; http://securitytracker.com/id?1017293; ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-026.txt.asc
CVE: CVE-2006-6654
Published: 2006-12-20
Description: The sendmsg function in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029, when run on a 64-bit architecture, allows attackers to cause a denial of service (kernel panic) via an invalid msg_controllen parameter to the sendit function.
CVSS Score: 4.3 (MEDIUM)
References: ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-026.txt.asc; http://securitytracker.com/id?1017293; ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-026.txt.asc
CVE: CVE-2006-6655
Published: 2006-12-20
Description: The procfs implementation in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029 allows local users to cause a denial of service (kernel panic) by attempting to access /emul/linux/proc/0/stat on a procfs filesystem that was mounted with mount_procfs -o linux, which results in a NULL pointer dereference.
CVSS Score: 1.7 (LOW)
References: ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-026.txt.asc; http://securitytracker.com/id?1017293; ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-026.txt.asc
CVE: CVE-2006-6656
Published: 2006-12-20
Description: Unspecified vulnerability in ptrace in NetBSD-current before 20061027, NetBSD 3.0 and 3.0.1 before 20061027, and NetBSD 2.x before 20061119 allows local users to read kernel memory and obtain sensitive information via certain manipulations of a PT_LWPINFO request, which leads to a memory leak and information leak.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-025.txt.asc; http://securitytracker.com/id?1017292; ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-025.txt.asc
CVE: CVE-2006-6657
Published: 2006-12-20
Description: The if_clone_list function in NetBSD-current before 20061027, NetBSD 3.0 and 3.0.1 before 20061027, and NetBSD 2.x before 20061119 allows local users to read potentially sensitive, uninitialized stack memory via unspecified vectors.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-025.txt.asc; http://securitytracker.com/id?1017292; ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2006-025.txt.asc
CVE: CVE-2006-6658
Published: 2006-12-20
Description: Inktomi Search 4.1.4 allows remote attackers to obtain sensitive information via direct requests with missing parameters to (1) help/header.html, (2) thesaurus.html, and (3) topics.html, which leak the installation path in the resulting error message, a related issue to CVE-2006-5970.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1017242; http://securitytracker.com/id?1017242
CVE: CVE-2006-6659
Published: 2006-12-20
Description: The Microsoft Office Outlook Recipient ActiveX control (ole32.dll) in Windows XP SP2 allows remote attackers to cause a denial of service (Internet Explorer 7 hang) via crafted HTML.
CVSS Score: 5.0 (MEDIUM)
References: http://securitytracker.com/id?1017397; http://shinnai.altervista.org/viewtopic.php?id=41&t_id=8; http://www.securityfocus.com/bid/21649
CVE: CVE-2006-6660
Published: 2006-12-20
Description: The nodeType function in KDE libkhtml 4.2.0 and earlier, as used by Konquerer, KMail, and other programs, allows remote attackers to cause a denial of service (crash) via malformed HTML tags, possibly involving a COL SPAN tag embedded in a RANGE tag.
CVSS Score: 4.3 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/21662.html; http://www.securityfocus.com/bid/21662; http://www.vupen.com/english/advisories/2006/5071
CVE: CVE-2006-6661
Published: 2006-12-20
Description: Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code via multiple vectors that use the extract function, as demonstrated by the (1) f, (2) newmessage, (3) newusername, (4) adminuser, and (5) permission parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23407; http://www.vupen.com/english/advisories/2006/5088; https://www.exploit-db.com/exploits/2953
CVE: CVE-2006-6662
Published: 2006-12-20
Description: Unspecified vulnerability in Linux User Management (novell-lum) on SUSE Linux Enterprise Desktop 10 and Open Enterprise Server 9, under unspecified conditions, allows local users to log in to the console without a password.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/23409; http://www.novell.com/linux/security/advisories/2006_29_sr.html; http://secunia.com/advisories/23409
CVE: CVE-2006-6663
Published: 2006-12-20
Description: The server component in Marathon Aleph One before 0.17.1 and 2006-12-17 allows remote attackers to cause a denial of service (application crash) via unspecified vectors related to "gathering net games."
CVSS Score: 5.0 (MEDIUM)
References: http://marathon.sourceforge.net/release-notes/20061202.html; http://secunia.com/advisories/23380; http://sourceforge.net/project/shownotes.php?release_id=471964
CVE: CVE-2006-6664
Published: 2006-12-20
Description: Format string vulnerability in Marathon Aleph One before 0.17.1 and 2006-12-17 might allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in the TopLevelLogger::logMessageV function in Misc/Logging.cpp.  NOTE: some details were obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://marathon.sourceforge.net/release-notes/20061202.html; http://secunia.com/advisories/23380; http://sourceforge.net/project/shownotes.php?release_id=471964
CVE: CVE-2006-6665
Published: 2006-12-20
Description: Buffer overflow in Astonsoft DeepBurner Pro and Free 1.8.0 and earlier allows user-assisted remote attackers to execute arbitrary code via a long file name tag in a dbr file.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23367; http://www.securityfocus.com/bid/21657; http://www.vupen.com/english/advisories/2006/5066
CVE: CVE-2006-6666
Published: 2006-12-20
Description: PHP remote file inclusion vulnerability in index.php in VerliAdmin 0.3 and earlier allows remote authenticated users to execute arbitrary PHP code via a URL in the q parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23418; http://www.securityfocus.com/bid/21640; http://www.vupen.com/english/advisories/2006/5059