deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-0891
Published: 2006-02-25
Description: Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accept-Language HTTP header field, when force_default_lang is disabled, in (b) index.php, as demonstrated by injecting PHP code into a profile and accessing it using the lang parameter in index.php.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0418.html; http://retrogod.altervista.org/noccw_10_incl_xpl.html; http://secunia.com/advisories/16921
CVE: CVE-2006-0892
Published: 2006-02-25
Description: NOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames, which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0418.html; http://retrogod.altervista.org/noccw_10_incl_xpl.html; http://secunia.com/advisories/16921
CVE: CVE-2006-0893
Published: 2006-02-25
Description: NOCC Webmail 1.0 allows remote attackers to obtain sensitive information via a direct request to (1) the profiles directory, which leaks e-mail addresses contained in filenames of profiles, and (2) the tmp directory, which lists names of uploaded attachments.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0418.html; http://retrogod.altervista.org/noccw_10_incl_xpl.html; http://secunia.com/advisories/16921
CVE: CVE-2006-0894
Published: 2006-02-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in NOCC Webmail 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the html_error_occurred parameter in error.php, (2) html_filter_select parameter in filter_prefs.php, (3) html_no_mail parameter in no_mail.php, the (4) page_line, (5) prev, and (6) next parameters in html_bottom_table.php, and the (7) _SESSION['nocc_theme'] parameter in footer.php.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0418.html; http://retrogod.altervista.org/noccw_10_incl_xpl.html; http://secunia.com/advisories/16921
CVE: CVE-2006-0895
Published: 2006-02-25
Description: NOCC Webmail 1.0 allows remote attackers to obtain the installation path via a direct request to html/header.php.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2006-02/0418.html; http://retrogod.altervista.org/noccw_10_incl_xpl.html; http://secunia.com/advisories/16921
CVE: CVE-2006-0896
Published: 2006-02-25
Description: Cross-site scripting (XSS) vulnerability in Sources/Register.php in Simple Machine Forum (SMF) 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the X-Forwarded-For HTTP header field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://attrition.org/pipermail/vim/2006-April/000682.html; http://evuln.com/vulns/86/summary.html; http://secunia.com/advisories/19004
CVE: CVE-2006-0897
Published: 2006-02-25
Description: SQL injection vulnerability in VCS Virtual Program Management Intranet (VPMi) Enterprise 3.3 allows remote attackers to execute arbitrary SQL commands via the UpdateID0 parameter to Service_Requests.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: the vendor has disputed this issue, saying that "[we] have a behind the scenes complex state management system that uses a combination of keys placed in JavaScript and Session State (server side) that protects against the type of SQL injection you describe.  We have tested for many of the cases and have not found it to be an issue."  Further investigation suggests that the original researcher might have triggered errors using invalid field values, which is not proof of SQL injection; however, the vendor did not receive a response from the original researcher
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/18842; http://www.attrition.org/pipermail/vim/2006-March/000598.html; http://www.attrition.org/pipermail/vim/2006-March/000599.html
CVE: CVE-2006-0898
Published: 2006-02-25
Description: Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.
CVSS Score: 2.6 (LOW)
References: http://rhn.redhat.com/errata/RHSA-2008-0630.html; http://secunia.com/advisories/18755; http://secunia.com/advisories/19187
CVE: CVE-2006-0899
Published: 2006-02-27
Description: Directory traversal vulnerability in index.php in 4Images 1.7.1 and earlier allows remote attackers to read and include arbitrary files via ".." (dot dot) sequences in the template parameter.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/4images_171_adv.html; http://secunia.com/advisories/19026; http://securityreason.com/securityalert/518
CVE: CVE-2006-0900
Published: 2006-02-27
Description: nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service via a crafted NFS mount request, as demonstrated by the ProtoVer NFS test suite.
CVSS Score: 7.8 (HIGH)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:10.nfs.asc; http://lists.immunitysec.com/pipermail/dailydave/2006-February/002982.html; http://secunia.com/advisories/19017
CVE: CVE-2006-0901
Published: 2006-02-27
Description: Unspecified vulnerability in the hsfs filesystem in Solaris 8, 9, and 10 allows unspecified attackers to cause a denial of service (panic) or execute arbitrary code.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/19042; http://securitytracker.com/id?1015680; http://sunsolve.sun.com/search/document.do?assetkey=1-26-102161-1
CVE: CVE-2006-0736
Published: 2006-02-27
Description: Stack-based buffer overflow in the pam_micasa PAM authentication module in CASA on Novell Linux Desktop 9 and Open Enterprise Server 1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/18995; http://www.novell.com/linux/security/advisories/2006_10_casa.html; http://www.securityfocus.com/bid/16779
CVE: CVE-2006-0903
Published: 2006-02-27
Description: MySQL 5.0.18 and earlier allows local users to bypass logging mechanisms via SQL queries that contain the NULL character, which are not properly handled by the mysql_real_query function.  NOTE: this issue was originally reported for the mysql_query function, but the vendor states that since mysql_query expects a null character, this is not an issue for mysql_query.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0653.html; http://bugs.mysql.com/bug.php?id=17667; http://rst.void.ru/papers/advisory39.txt
CVE: CVE-2006-0906
Published: 2006-02-28
Description: SQL injection vulnerability in D3Jeeb Pro 3 allows remote attackers to execute arbitrary SQL commands via the catid parameter in (1) fastlinks.php and (2) catogary.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/19062; http://securitytracker.com/id?1015687; http://www.securityfocus.com/archive/1/426197/100/0/threaded
CVE: CVE-2006-0907
Published: 2006-02-28
Description: SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/426083/100/0/threaded; http://www.waraxe.us/advisory-47.html; http://www.securityfocus.com/archive/1/426083/100/0/threaded
CVE: CVE-2006-0908
Published: 2006-02-28
Description: PHP-Nuke 7.8 Patched 3.2 allows remote attackers to bypass SQL injection protection mechanisms via /%2a (/*) sequences with the "ad_click" word in the query string, as demonstrated via the kala parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/497; http://www.securityfocus.com/archive/1/426083/100/0/threaded; http://www.waraxe.us/advisory-47.html
CVE: CVE-2006-0909
Published: 2006-02-28
Description: Invision Power Board (IPB) 2.1.4 and earlier allows remote attackers to view sensitive information via a direct request to multiple PHP scripts that include the full path in error messages, including (1) PEAR/Text/Diff/Renderer/inline.php, (2) PEAR/Text/Diff/Renderer/unified.php, (3) PEAR/Text/Diff3.php, (4) class_db.php, (5) class_db_mysql.php, and (6) class_xml.php in the ips_kernel/ directory; (7) mysql_admin_queries.php, (8) mysql_extra_queries.php, (9) mysql_queries.php, and (10) mysql_subsm_queries.php in the sources/sql directory; (11) sources/acp_loaders/acp_pages_components.php; (12) sources/action_admin/member.php and (13) sources/action_admin/paysubscriptions.php; (14) login.php, (15) messenger.php, (16) moderate.php, (17) paysubscriptions.php, (18) register.php, (19) search.php, (20) topics.php, (21) and usercp.php in the sources/action_public directory; (22) bbcode/class_bbcode.php, (23) bbcode/class_bbcode_legacy.php, (24) editor/class_editor_rte.php, (25) editor/class_editor_std.php, (26) post/class_post.php, (27) post/class_post_edit.php, (28) post/class_post_new.php, (29) and post/class_post_reply.php in the sources/classes directory; (30) sources/components_acp/registration_DEPR.php; (31) sources/handlers/han_paysubscriptions.php; (32) func_usercp.php; (33) search_mysql_ftext.php, and (34) search_mysql_man.php in the sources/lib/ directory; and (35) convert/auth.php.bak, (36) external/auth.php, and (37) ldap/auth.php in the sources/loginauth directory.
CVSS Score: 5.0 (MEDIUM)
References: http://neosecurityteam.net/advisories/Advisory-16.txt; http://neosecurityteam.net/index.php?action=advisories&id=16; http://www.securityfocus.com/archive/1/425713/100/0/threaded
CVE: CVE-2006-0910
Published: 2006-02-28
Description: Invision Power Board (IPB) 2.1.4 and earlier allows remote attackers to list directory contents via a direct request to multiple directories, including (1) sources/loginauth/convert/, (2) sources/portal_plugins/, (3) cache/skin_cache/cacheid_2/, (4) ips_kernel/PEAR/, (5) ips_kernel/PEAR/Text/, (6) ips_kernel/PEAR/Text/Diff/, (7) ips_kernel/PEAR/Text/Diff/Renderer/, (8) style_images/1/folder_rte_files/, (9) style_images/1/folder_js_skin/, (10) style_images/1/folder_rte_images/, and (11) upgrade/ and its subdirectories.
CVSS Score: 5.0 (MEDIUM)
References: http://neosecurityteam.net/advisories/Advisory-16.txt; http://neosecurityteam.net/index.php?action=advisories&id=16; http://www.securityfocus.com/archive/1/425713/100/0/threaded
CVE: CVE-2006-0911
Published: 2006-02-28
Description: NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumption) via crafted requests to Login.asp, possibly involving the (1) "In]" and (2) "b;tnLogIn" parameters, or (3) malformed btnLogIn parameters, possibly involving missing "[" (open bracket) or "[" (closing bracket) characters, as demonstrated by "&btnLogIn=[Log&In]=&" or "&b;tnLogIn=[Log&In]=&" in the URL.  NOTE: due to the lack of diagnosis by the original researcher, the precise nature of the vulnerability is unclear.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://securityreason.com/securityalert/472; http://www.osvdb.org/23494; http://www.securityfocus.com/archive/1/425780/100/0/threaded
CVE: CVE-2006-0912
Published: 2006-02-28
Description: Oreka before 0.5 allows remote attackers to cause a denial of service (application crash) via a "certain RTP sequence."
CVSS Score: 5.0 (MEDIUM)
References: http://oreka.sourceforge.net/; http://secunia.com/advisories/19095; http://www.osvdb.org/23300
CVE: CVE-2006-0913
Published: 2006-02-28
Description: SQL injection vulnerability in whineatnews.pl in Bugzilla 2.17 through 2.18.4 and 2.20 allows remote authenticated users with administrative privileges to execute arbitrary SQL commands via the whinedays parameter, as accessible from editparams.cgi.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/18979; http://www.osvdb.org/23378; http://www.securityfocus.com/archive/1/425584/100/0/threaded
CVE: CVE-2006-0914
Published: 2006-02-28
Description: Bugzilla 2.16.10, 2.17 through 2.18.4, and 2.20 does not properly handle certain characters in the mostfreqthreshold parameter in duplicates.cgi, which allows remote attackers to trigger a SQL error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/425584/100/0/threaded; http://www.vupen.com/english/advisories/2006/0692; https://bugzilla.mozilla.org/show_bug.cgi?id=312498
CVE: CVE-2006-0915
Published: 2006-02-28
Description: Bugzilla 2.16.10 does not properly handle certain characters in the (1) maxpatchsize and (2) maxattachmentsize parameters in attachment.cgi, which allows remote attackers to trigger a SQL error.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/0692; https://bugzilla.mozilla.org/show_bug.cgi?id=313441; http://www.vupen.com/english/advisories/2006/0692
CVE: CVE-2006-0916
Published: 2006-02-28
Description: Bugzilla 2.19.3 through 2.20 does not properly handle "//" sequences in URLs when redirecting a user from the login form, which could cause it to generate a partial URL in a form action that causes the user's browser to send the form data to another domain.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18979; http://securityreason.com/securityalert/464; http://www.securityfocus.com/archive/1/425584/100/0/threaded
CVE: CVE-2006-0917
Published: 2006-02-28
Description: Melange Chat Server (aka M-Chat), when accessed via a web browser, automatically sends cookies and other sensitive information for a server to any port specified in the associated link, which allows local users on that server to read the cookies from HTTP headers and possibly gain sensitive information, such as credentials, by setting up a listening port and reading the credentials when the victim clicks on the link.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/18984; http://securityreason.com/securityalert/463; http://www.oh2600.com/forum/viewtopic.php?t=43
CVE: CVE-2006-0918
Published: 2006-02-28
Description: Buffer overflow in RITLabs The Bat! 3.60.07 allows remote attackers to execute arbitrary code via a long Subject field.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18989; http://securityreason.com/securityalert/485; http://www.nsag.ru/vuln/953.html
CVE: CVE-2006-0919
Published: 2006-02-28
Description: SQL injection vulnerability in index.php (aka the login page) in Oi! Email Marketing System 3.0 (aka Oi! 3) allows remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18993; http://www.h4cky0u.org/advisories/HYSA-2006-003-oi-email.txt; http://www.osvdb.org/23462
CVE: CVE-2006-0920
Published: 2006-02-28
Description: Oi! Email Marketing System 3.0 (aka Oi! 3) stores the server's FTP password in cleartext on a Configuration web page, which allows local users with superadministrator privileges, or attackers who have obtained access to the web page, to view the password.
CVSS Score: 1.7 (LOW)
References: http://securityreason.com/securityalert/483; http://www.h4cky0u.org/advisories/HYSA-2006-003-oi-email.txt; http://www.securityfocus.com/archive/1/425924/100/0/threaded
CVE: CVE-2006-0921
Published: 2006-02-28
Description: Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attackers to list and create arbitrary directories via a .. (dot dot) in the CurrentFolder parameter to (1) GetFoldersAndFiles and (2) CreateFolder.
CVSS Score: 6.4 (MEDIUM)
References: http://securityreason.com/securityalert/484; http://www.nsag.ru/vuln/952.html; http://www.securityfocus.com/archive/1/425937/100/0/threaded
CVE: CVE-2006-0922
Published: 2006-02-28
Description: CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results in an absolute path traversal vulnerability in FileUpload in connector.php (aka upload.php) that allows remote attackers to upload arbitrary files via a modified CurrentFolder parameter in a direct request to admin/filemanager/upload.php.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/482; http://www.cubecart.com/site/forums/index.php?showtopic=14704; http://www.cubecart.com/site/forums/index.php?showtopic=14817
CVE: CVE-2006-0923
Published: 2006-02-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the letter parameter in reviews.php and (2) the dcategory parameter in download.php.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19052; http://securityreason.com/securityalert/491; http://www.myphpnuke.com/article.php?sid=1035&mode=thread&order=0
CVE: CVE-2006-0924
Published: 2006-02-28
Description: Cross-site scripting (XSS) vulnerability in Brown Bear iCal 3.10 allows remote attackers to inject arbitrary web script or HTML via the Calendar Text field when a new event is added.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/19001; http://www.osvdb.org/23472; http://www.securityfocus.com/bid/16845
CVE: CVE-2006-0925
Published: 2006-02-28
Description: Format string vulnerability in the IMAP4rev1 server in Alt-N MDaemon 8.1.1 and possibly 8.1.4 allows remote attackers to cause a denial of service (CPU consumption) by creating and then listing folders whose names contain format string specifiers.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18921; http://www.nsag.ru/vuln/888.html; http://www.securityfocus.com/bid/16854
CVE: CVE-2006-0926
Published: 2006-02-28
Description: Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/19010; http://www.hamid.ir/security/stuffit.txt; http://www.osvdb.org/23463
CVE: CVE-2006-0927
Published: 2006-02-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board (wBB) 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) userid parameter in (a) jgs_galerie_slideshow.php and (b) jgs_galerie_scroll.php, and the (2) katid parameter in (c) jgs_galerie_slideshow.php.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0615.html; http://www.nukedx.com/?viewdoc=11; http://www.securityfocus.com/archive/1/425981/100/0/threaded
CVE: CVE-2006-0928
Published: 2006-02-28
Description: The POP3 Server in ArGoSoft Mail Server Pro 1.8 allows remote attackers to obtain sensitive information via the _DUMP command, which reveals the operating system, registered user, and registration code.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/18990; http://www.nsag.ru/vuln/879.html; http://www.securityfocus.com/archive/1/425968/100/0/threaded
CVE: CVE-2006-0929
Published: 2006-02-28
Description: Directory traversal vulnerability in the IMAP server in ArGoSoft Mail Server Pro 1.8.8.1 allows remote authenticated users to create arbitrary folders via a .. (dot dot) in the RENAME command.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/18990; http://www.nsag.ru/vuln/878.html; http://www.securityfocus.com/archive/1/425969/100/0/threaded
CVE: CVE-2006-0930
Published: 2006-02-28
Description: Directory traversal vulnerability in Webmail in ArGoSoft Mail Server Pro 1.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the UIDL parameter.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/18990; http://securityreason.com/securityalert/487; http://www.nsag.ru/vuln/877.html
CVE: CVE-2006-0931
Published: 2006-02-28
Description: Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://pear.php.net/bugs/bug.php?id=6933; http://pear.php.net/package/Archive_Tar/download/; http://secunia.com/advisories/19011
CVE: CVE-2006-0932
Published: 2006-02-28
Description: Directory traversal vulnerability in zip.lib.php 0.1.1 in PEAR::Archive_Zip allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a ZIP archive.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/486; http://www.hamid.ir/security/phpzip.txt; http://www.securityfocus.com/archive/1/425967/100/0/threaded
CVE: CVE-2006-0933
Published: 2006-02-28
Description: Cross-site scripting (XSS) vulnerability in PHPX 3.5.9 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in a url XCode tag in a posted message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18688; http://www.securityfocus.com/bid/16799; http://www.vupen.com/english/advisories/2006/0722
CVE: CVE-2006-0934
Published: 2006-02-28
Description: Cross-site scripting (XSS) vulnerability in webinsta Limbo 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML via the message field in the Contact Form.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/ref/23/23469-limbo.txt; http://secunia.com/advisories/18723; http://www.osvdb.org/23469
CVE: CVE-2006-0935
Published: 2006-02-28
Description: Microsoft Word 2003 allows remote attackers to cause a denial of service (application crash) via a crafted file, as demonstrated by 101_filefuzz.
CVSS Score: 2.6 (LOW)
References: http://archives.neohapsis.com/archives/dailydave/2006-q1/0179.html; http://www.securityfocus.com/bid/16782; http://archives.neohapsis.com/archives/dailydave/2006-q1/0179.html
CVE: CVE-2006-0936
Published: 2006-02-28
Description: Free Host Shop Website Generator 3.3 allows remote authenticated users with administrative privileges to upload and execute arbitrary files via a formname parameter with a filename containing a dangerous file extension and a trailing %00.
CVSS Score: 6.5 (MEDIUM)
References: http://nsag.ru/vuln/894.html; http://secunia.com/advisories/19014; http://www.securityfocus.com/archive/1/426077/100/0/threaded
CVE: CVE-2006-0937
Published: 2006-02-28
Description: U.N.U. Mailgust 1.9 allows remote attackers to obtain sensitive information via a direct request to index.php with method=showfullcsv, which reveals the POP3 server configuration, including account name and password.
CVSS Score: 5.0 (MEDIUM)
References: http://nsag.ru/vuln/890.html; http://secunia.com/advisories/18998; https://exchange.xforce.ibmcloud.com/vulnerabilities/24890
CVE: CVE-2006-0938
Published: 2006-03-01
Description: Cross-site scripting (XSS) vulnerability in eZ publish 3.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the RefererURL parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securitytracker.com/id?1015683; http://www.nukedx.com/?viewdoc=16; http://www.securityfocus.com/archive/1/426076/100/0/threaded