deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6486
Published: 2006-12-12
Description: SQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via unspecified vectors in sptrees/default.aspx, possibly involving the docId parameter.  NOTE: this issue appears to have been disputed by a third party researcher, stating that SQL injection is not possible. However, insufficient details were provided to evaluate the dispute.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/453575/100/100/threaded; http://www.securityfocus.com/archive/1/453586/100/100/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/30755
CVE: CVE-2006-6493
Published: 2006-12-13
Description: Buffer overflow in the krbv4_ldap_auth function in servers/slapd/kerberos.c in OpenLDAP 2.4.3 and earlier, when OpenLDAP is compiled with the --enable-kbind (Kerberos KBIND) option, allows remote attackers to execute arbitrary code via an LDAP bind request using the LDAP_AUTH_KRBV41 authentication method and long credential data.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/23334; http://securityreason.com/securityalert/2023; http://www.phreedom.org/solar/exploits/openldap-kbind
CVE: CVE-2006-2386
Published: 2006-12-13
Description: Unspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact record in a Windows Address Book (WAB) file.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23311; http://securitytracker.com/id?1017369; http://www.securityfocus.com/archive/1/454969/100/200/threaded
CVE: CVE-2006-4702
Published: 2006-12-13
Description: Buffer overflow in the Windows Media Format Runtime in Microsoft Windows Media Player (WMP) 6.4 and Windows XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted Advanced Systems Format (ASF) file.
CVSS Score: 6.8 (MEDIUM)
References: http://securitytracker.com/id?1017372; http://support.avaya.com/elmodocs2/security/ASA-2006-274.htm; http://www.securityfocus.com/archive/1/454969/100/200/threaded
CVE: CVE-2006-5584
Published: 2006-12-13
Description: The Remote Installation Service (RIS) in Microsoft Windows 2000 SP4 uses a TFTP server that allows anonymous access, which allows remote attackers to upload and overwrite arbitrary files to gain privileges on systems that use RIS.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23312; http://securitytracker.com/id?1017368; http://www.kb.cert.org/vuls/id/238064
CVE: CVE-2006-5585
Published: 2006-12-13
Description: The Client-Server Run-time Subsystem in Microsoft Windows XP SP2 and Server 2003 allows local users to gain privileges via a crafted file manifest within an application, aka "File Manifest Corruption Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/23308; http://secunia.com/advisories/23348; http://securitytracker.com/id?1017370
CVE: CVE-2006-6494
Published: 2006-12-13
Description: Directory traversal vulnerability in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via a .. (dot dot) sequence in the LANG environment variable that points to a locale file containing attacker-controlled format string specifiers.
CVSS Score: 6.6 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=449; http://secunia.com/advisories/23317; http://securitytracker.com/id?1017376
CVE: CVE-2006-6495
Published: 2006-12-13
Description: Stack-based buffer overflow in ld.so.1 in Sun Solaris 8, 9, and 10 allows local users to execute arbitrary code via large precision padding values in a format string specifier in the format parameter of the doprf function.  NOTE: this issue normally does not cross privilege boundaries, except in cases of external introduction of malicious message files, or if it is leveraged with other vulnerabilities such as CVE-2006-6494.
CVSS Score: 6.6 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=450; http://secunia.com/advisories/23317; http://secunia.com/advisories/23991
CVE: CVE-2006-6496
Published: 2006-12-13
Description: The (1) VetMONNT.sys and (2) VetFDDNT.sys drivers in CA Anti-Virus 2007 8.1, Anti-Virus for Vista Beta 8.2, and CA Internet Security Suite 2007 v3.0 do not properly handle NULL buffers, which allows local users with administrative access to cause a denial of service (system crash) via certain IOCTLs.
CVSS Score: 6.6 (MEDIUM)
References: http://crm.my-etrust.com/CIDocument.asp?KDId=2651&GUID=9FD7E4F8362C4A168D88B4FFA34DCB4C; http://secunia.com/advisories/23378; http://securitytracker.com/id?1017381
CVE: CVE-2006-5648
Published: 2006-12-14
Description: Ubuntu Linux 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (resource consumption) by using the (1) sys_get_robust_list and (2) sys_set_robust_list functions to create processes that cannot be killed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://secunia.com/advisories/23361; http://secunia.com/advisories/23384; http://secunia.com/advisories/23474
CVE: CVE-2006-5649
Published: 2006-12-14
Description: Unspecified vulnerability in the "alignment check exception handling" in Ubuntu 5.10, 6.06 LTS, and 6.10 for the PowerPC (PPC) allows local users to cause a denial of service (kernel panic) via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://secunia.com/advisories/23361; http://secunia.com/advisories/23370; http://secunia.com/advisories/23384
CVE: CVE-2006-5875
Published: 2006-12-14
Description: eoc.py in Enemies of Carlotta (EoC) before 1.2.4 allows remote attackers to execute arbitrary commands via shell metacharacters in an "SMTP level e-mail address".
CVSS Score: 6.8 (MEDIUM)
References: http://liw.iki.fi/lists/eoc%40liw.iki.fi/msg00366.html; http://secunia.com/advisories/23377; http://secunia.com/advisories/23382
CVE: CVE-2006-6107
Published: 2006-12-14
Description: Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).
CVSS Score: 1.7 (LOW)
References: http://archives.mandrivalinux.com/security-announce/2006-12/msg00025.php; http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html; http://lists.rpath.com/pipermail/security-announce/2007-February/000147.html
CVE: CVE-2006-6508
Published: 2006-12-14
Description: Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.21 allows remote authenticated users to send unauthorized messages as an arbitrary user via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.0 (MEDIUM)
References: http://secunia.com/advisories/23283; http://secunia.com/advisories/28871; http://www.debian.org/security/2008/dsa-1488
CVE: CVE-2006-6509
Published: 2006-12-14
Description: Cross-site scripting (XSS) vulnerability in the skinning feature in SiteKiosk before 6.5.150 allows local users to bypass security protections and inject arbitrary web script or HTML via an ABOUT: URI, which is displayed in the title bar of the browser.
CVSS Score: 4.1 (MEDIUM)
References: http://secunia.com/advisories/23253; http://securityreason.com/securityalert/2024; http://www.securityfocus.com/archive/1/454185/100/0/threaded
CVE: CVE-2006-6510
Published: 2006-12-14
Description: An unspecified ActiveX control in SiteKiosk before 6.5.150 is installed "safe for scripting", which allows local users to bypass security protections and read arbitrary files via certain functions.
CVSS Score: 1.7 (LOW)
References: http://secunia.com/advisories/23253; http://www.securityfocus.com/archive/1/454185/100/0/threaded; http://www.securityfocus.com/bid/21567
CVE: CVE-2006-6511
Published: 2006-12-14
Description: dadaIMC .99.3 uses an insufficiently restrictive FilesMatch directive in the installed .htaccess file, which allows remote attackers to execute arbitrary PHP code by uploading files whose names contain (1) feature, (2) editor, (3) newswire, (4) otherpress, (5) admin, (6) pbook, (7) media, or (8) mod, which are processed as PHP file types (application/x-httpd-php).
CVSS Score: 6.8 (MEDIUM)
References: http://bugs.dadaimc.org/view.php?id=191; http://secunia.com/advisories/23305; http://www.vupen.com/english/advisories/2006/4977
CVE: CVE-2006-6512
Published: 2006-12-14
Description: Directory traversal vulnerability in the Browse function (/browse URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to list arbitrary directories via URL encoded backslashes ("%2F") in the path parameter.
CVSS Score: 3.5 (LOW)
References: http://aluigi.altervista.org/adv/wawix-adv.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051217.html; http://secunia.com/advisories/23292
CVE: CVE-2006-6513
Published: 2006-12-14
Description: The CControl::Download function (/dl URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to download arbitrary file types under the root via a trailing "." (dot) in a filename in the file parameter, related to erroneous behavior of the IsWinampFile function.
CVSS Score: 3.5 (LOW)
References: http://aluigi.altervista.org/adv/wawix-adv.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051217.html; http://secunia.com/advisories/23292
CVE: CVE-2006-6514
Published: 2006-12-14
Description: Winamp Web Interface (Wawi) 7.5.13 and earlier uses an insufficient comparison to determine whether a directory is located below the application's root directory, which allows remote authenticated users to access certain other directories if the name of the root directory is a substring of the name of the target directory, as demonstrated by accessing C:\folder2 when the root directory is C:\folder.
CVSS Score: 3.5 (LOW)
References: http://aluigi.altervista.org/adv/wawix-adv.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051217.html; http://secunia.com/advisories/23292
CVE: CVE-2006-6515
Published: 2006-12-14
Description: Mantis before 1.1.0a2 sets the default value of $g_bug_reminder_threshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly related to frequency of reminders.
CVSS Score: 10.0 (HIGH)
References: http://sourceforge.net/project/shownotes.php?release_id=469627; http://www.mantisbugtracker.com/changelog.php; http://sourceforge.net/project/shownotes.php?release_id=469627
CVE: CVE-2006-6516
Published: 2006-12-14
Description: Multiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) page parameter to (a) index.php3, or the (2) lib_path parameter to (b) authenticate.inc.php3 or (c) lib/exifer/exif.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23313; http://www.securityfocus.com/archive/1/453962/100/0/threaded; http://www.securityfocus.com/bid/21515
CVE: CVE-2006-6517
Published: 2006-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in KDPics 1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) categories parameter to (a) index.php3 or (b) galeries.inc.php3.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23313; http://www.securityfocus.com/archive/1/453962/100/0/threaded; http://www.securityfocus.com/bid/21515
CVE: CVE-2006-6518
Published: 2006-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo, (2) email, (3) date, (4) sujet, (5) message, (6) site, and (7) lien parameters to (a) admin/change.php, and the (8) aa parameter to (b) lire-avis.php.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2025; http://www.securityfocus.com/archive/1/453964/100/0/threaded; http://www.securityfocus.com/bid/21516
CVE: CVE-2006-6519
Published: 2006-12-14
Description: SQL injection vulnerability in lire-avis.php in ProNews 1.5 allows remote attackers to execute arbitrary SQL commands via the aa parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2025; http://www.securityfocus.com/archive/1/453964/100/0/threaded; http://www.securityfocus.com/bid/21516
CVE: CVE-2006-6520
Published: 2006-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Messageriescripthp 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo parameter to (a) existepseudo.php, the (2) email parameter to (b) existeemail.php, or the (3) pageName or (4) cssform parameter to (c) Contact/contact.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23319; http://securityreason.com/securityalert/2026; http://www.securityfocus.com/archive/1/453965/100/0/threaded
CVE: CVE-2006-6521
Published: 2006-12-14
Description: SQL injection vulnerability in lire-avis.php in Messageriescripthp 2.0 allows remote attackers to execute arbitrary SQL commands via the aa parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23319; http://securityreason.com/securityalert/2026; http://www.securityfocus.com/archive/1/453965/100/0/threaded
CVE: CVE-2006-6522
Published: 2006-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in WikiTimeScale TwoZero before 2.31 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the (1) forum module and (2) event descriptions.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/4909; http://www.wikitimescale.org/versionlist.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/30784
CVE: CVE-2006-6523
Published: 2006-12-14
Description: Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML via the account parameter.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23302; http://securityreason.com/securityalert/2028; http://www.aria-security.com/forum/showthread.php?t=67
CVE: CVE-2006-6524
Published: 2006-12-14
Description: SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the Uname (UserName) parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23304; http://www.vupen.com/english/advisories/2006/4934; https://exchange.xforce.ibmcloud.com/vulnerabilities/30847
CVE: CVE-2006-6525
Published: 2006-12-14
Description: SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the password parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23304; https://exchange.xforce.ibmcloud.com/vulnerabilities/30847; http://secunia.com/advisories/23304
CVE: CVE-2006-6526
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in index.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/466032/100/0/threaded; http://www.securityfocus.com/bid/21524; http://www.vupen.com/english/advisories/2006/4929
CVE: CVE-2006-6527
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in guest.php in Gizzar 03162002 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the basePath parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/4929; http://www.vupen.com/english/advisories/2006/4929
CVE: CVE-2006-6528
Published: 2006-12-14
Description: The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/102614; http://secunia.com/advisories/23343; http://www.vupen.com/english/advisories/2006/4942
CVE: CVE-2006-6529
Published: 2006-12-14
Description: The Chatroom Module before 4.7.x.-1.0 for Drupal displays private messages in a chatroom's last messages overview, which allows remote attackers to obtain sensitive information by reading the overview.
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/102614; http://secunia.com/advisories/23343; http://drupal.org/node/102614
CVE: CVE-2006-6530
Published: 2006-12-14
Description: SQL injection vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/102605; http://secunia.com/advisories/23295; http://www.vupen.com/english/advisories/2006/4941
CVE: CVE-2006-6531
Published: 2006-12-14
Description: Cross-site scripting (XSS) vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML, and possibly obtain administrative access, via node titles.
CVSS Score: 6.8 (MEDIUM)
References: http://drupal.org/node/102605; http://secunia.com/advisories/23295; http://www.vupen.com/english/advisories/2006/4941
CVE: CVE-2006-6532
Published: 2006-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) StrMsg or (2) Topic_ID parameter to (a) vf_info.asp, (b) vf_newtopic.asp, (c) vf_settings.asp, and (d) vf_replytopic.asp, different vectors than CVE-2006-6447.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/4850; https://exchange.xforce.ibmcloud.com/vulnerabilities/30725; http://www.vupen.com/english/advisories/2006/4850
CVE: CVE-2006-6533
Published: 2006-12-14
Description: Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. (dot dot) in the filter parameter.  NOTE: this issue can be leveraged to obtain full path information in error messages.
CVSS Score: 7.5 (HIGH)
References: http://lostmon.blogspot.com/2006/12/oscommerce-traversal-arbitrary-file.html; http://securitytracker.com/id?1017353; http://www.securityfocus.com/bid/21477
CVE: CVE-2006-6534
Published: 2006-12-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 3.0a3 allow remote attackers to inject arbitrary web script or HTML via the (1) set parameter to admin/modules.php, the (2) selected_box parameter to definitiva/admin/customers.php, the (3) lID parameter to admin/languages_definitions.php, or the (4) pID parameter to admin/products.php.
CVSS Score: 4.3 (MEDIUM)
References: http://lostmon.blogspot.com/2006/12/oscommerce-traversal-arbitrary-file.html; http://securitytracker.com/id?1017353; http://www.securityfocus.com/bid/21477
CVE: CVE-2006-6536
Published: 2006-12-14
Description: Cross-site scripting (XSS) vulnerability in hata.asp in Cilem Haber Free Edition allows remote attackers to inject arbitrary web script or HTML via the hata parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/21511; http://www.securityfocus.com/bid/21511
CVE: CVE-2006-6537
Published: 2006-12-14
Description: IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/22652; http://securityreason.com/securityalert/2030; http://www.securityfocus.com/archive/1/454050/100/0/threaded
CVE: CVE-2006-6538
Published: 2006-12-14
Description: D-LINK DWL-2000AP+ firmware 2.11 allows remote attackers to cause (1) a denial of service (device reset) via a flood of ARP replies on the wired or wireless (radio) link and (2) a denial of service (device crash) via a flood of ARP requests on the wireless link.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/23332; http://securityreason.com/securityalert/2029; http://tripp.dynalias.org/arpflood.c
CVE: CVE-2006-6539
Published: 2006-12-14
Description: Multiple buffer overflows in Winamp Web Interface (Wawi) 7.5.13 and earlier (1) allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an (a) long username or a (b) crafted packet to the FindBasicAuth function in security.cpp, related to the /browse URI; and allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long path string in the (2) Browse, (3) CControl::Download, and (4) CControl::Load functions, related to the file parameter in the /dl URI.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
References: http://aluigi.altervista.org/adv/wawix-adv.txt; http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051217.html; http://secunia.com/advisories/23292
CVE: CVE-2006-6540
Published: 2006-12-14
Description: SQL injection vulnerability in bt-trackback.php in Bluetrait before 1.2.0, when trackback is enabled, allows remote attackers to execute arbitrary SQL commands via unspecified parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23316; http://www.bluetrait.org/weblog/changelog.txt; http://www.vupen.com/english/advisories/2006/4960
CVE: CVE-2006-6541
Published: 2006-12-14
Description: PHP remote file inclusion vulnerability in signer/final.php in warez distributions of Animated Smiley Generator allows remote attackers to execute arbitrary PHP code via a URL in the smiley parameter.  NOTE: the vendor disputes this issue, stating that only Warez versions of Animated Smiley Generator were affected, not the developer-provided software: "Legitimately purchased applications do not allow this exploit.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/2031; http://www.attrition.org/pipermail/vim/2006-December/001195.html; http://www.securityfocus.com/archive/1/453934/100/0/threaded
CVE: CVE-2006-6542
Published: 2006-12-14
Description: SQL injection vulnerability in news.php in Fantastic News 2.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/4931; https://exchange.xforce.ibmcloud.com/vulnerabilities/30834; https://www.exploit-db.com/exploits/2906
CVE: CVE-2006-6543
Published: 2006-12-14
Description: Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) login (UserName) and possibly (2) password parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/4932; https://exchange.xforce.ibmcloud.com/vulnerabilities/30835; https://www.exploit-db.com/exploits/2907
CVE: CVE-2006-6544
Published: 2006-12-14
Description: Cross-site scripting (XSS) vulnerability in CM68 News allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://cm68.de/?cm68news_download; http://www.vupen.com/english/advisories/2006/4911; http://cm68.de/?cm68news_download