deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-6444
Published: 2006-12-10
Description: Stack-based buffer overflow in Nostra DivX Player 2.1, 2.2.00.0, and possibly earlier, allows remote attackers to execute arbitrary code via a long string in an M3U file.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23272; http://www.securityfocus.com/bid/21480; http://www.vupen.com/english/advisories/2006/4892
CVE: CVE-2006-6445
Published: 2006-12-10
Description: Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/21413; http://www.vupen.com/english/advisories/2006/4836; https://exchange.xforce.ibmcloud.com/vulnerabilities/30700
CVE: CVE-2006-6446
Published: 2006-12-10
Description: SQL injection vulnerability in index.php in iWare Professional 5.0.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the D parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23076; http://www.securityfocus.com/bid/21467; https://exchange.xforce.ibmcloud.com/vulnerabilities/30743
CVE: CVE-2006-6447
Published: 2006-12-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in Vt-Forum Lite 1.3 and 1.5 allow remote attackers to inject arbitrary web script or HTML via (1) the StrMes parameter in vf_info.asp and possibly (2) a URL in the SRC attribute of an IFRAME element that is submitted to vf_newtopic.asp.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23226; http://securityreason.com/securityalert/2011; http://www.securityfocus.com/archive/1/453452/100/0/threaded
CVE: CVE-2006-6448
Published: 2006-12-10
Description: Multiple SQL injection vulnerabilities in Vt-Forum Lite 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via the user parameter to vf_memberdetail.asp, and other unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
References: http://www.vupen.com/english/advisories/2006/4850; https://exchange.xforce.ibmcloud.com/vulnerabilities/30726; http://www.vupen.com/english/advisories/2006/4850
CVE: CVE-2006-6449
Published: 2006-12-10
Description: Vt-Forum Lite 1.3 and earlier store sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/forum.mdb.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.4 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/4850; https://exchange.xforce.ibmcloud.com/vulnerabilities/30724; http://www.vupen.com/english/advisories/2006/4850
CVE: CVE-2006-6450
Published: 2006-12-10
Description: Multiple SQL injection vulnerabilities in dagent/downloadreport.asp in Novell ZENworks Patch Management (ZPM) before 6.3.2.700 allow remote attackers to execute arbitrary SQL commands via the (1) agentid and (2) pass parameters.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23243; http://www.securityfocus.com/bid/21473; http://www.vupen.com/english/advisories/2006/4864
CVE: CVE-2006-6451
Published: 2006-12-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in SWsoft Plesk 8.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) get_password.php or (2) login_up.php3.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]2206&w=2; http://securitytracker.com/id?1017236; http://www.majorsecurity.de/index_2.php?major_rls=major_rls34
CVE: CVE-2006-6452
Published: 2006-12-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in the MyArticles module before 0.6 beta 1, for RunCMS, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) topics.php, (2) submit.php, and (3) class/calendar.class.php.
CVSS Score: 6.8 (MEDIUM)
References: http://sourceforge.net/project/shownotes.php?release_id=466097; http://www.vupen.com/english/advisories/2006/4777; https://exchange.xforce.ibmcloud.com/vulnerabilities/30618
CVE: CVE-2006-6453
Published: 2006-12-10
Description: PHP remote file inclusion vulnerability in JOWAMP_ShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the link parameter.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/23276; http://www.securityfocus.com/bid/20836; http://www.vupen.com/english/advisories/2006/4905
CVE: CVE-2006-6454
Published: 2006-12-10
Description: execInBackground.php in J-OWAMP Web Interface 2.1b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters to the (1) exe and (2) args parameters, which are used in an exec function call.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
References: http://www.vupen.com/english/advisories/2006/4905; https://exchange.xforce.ibmcloud.com/vulnerabilities/30781; http://www.vupen.com/english/advisories/2006/4905
CVE: CVE-2006-6455
Published: 2006-12-10
Description: Multiple SQL injection vulnerabilities in admin/default.asp in DUware DUdirectory 3.1, and possibly DUdirectory Pro and Pro SQL 3.x, allow remote attackers to execute arbitrary SQL commands via the (1) Username or (2) Password parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23275; http://securityreason.com/securityalert/2017; http://www.securityfocus.com/archive/1/453809/100/0/threaded
CVE: CVE-2006-6456
Published: 2006-12-11
Description: Unspecified vulnerability in Microsoft Word 2000, 2002, and 2003 and Word Viewer 2003 allows remote attackers to execute code via unspecified vectors related to malformed data structures that trigger memory corruption, a different vulnerability than CVE-2006-5994.
CVSS Score: 9.3 (HIGH)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-12/0199.html; http://archives.neohapsis.com/archives/fulldisclosure/2006-12/0215.html; http://blogs.technet.com/msrc/archive/2006/12/10/new-report-of-a-word-zero-day.aspx
CVE: CVE-2006-6457
Published: 2006-12-11
Description: tiki-wiki_rss.php in Tikiwiki 1.9.5, 1.9.2, and possibly other versions allows remote attackers to obtain sensitive information (MySQL username and password) via an invalid (large or negative) ver parameter, which leaks the information in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/452639/100/200/threaded; http://www.securityfocus.com/archive/1/452639/100/200/threaded
CVE: CVE-2006-6458
Published: 2006-12-11
Description: The Trend Micro scan engine before 8.320 for Windows and before 8.150 on HP-UX and AIX, as used in Trend Micro PC Cillin - Internet Security 2006, Office Scan 7.3, and Server Protect 5.58, allows remote attackers to cause a denial of service (CPU consumption and system hang) via a malformed RAR archive with an Archive Header section with the head_size and pack_size fields set to zero, which triggers an infinite loop.
CVSS Score: 7.8 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=439; http://secunia.com/advisories/23321; http://www.securityfocus.com/bid/21509
CVE: CVE-2006-6459
Published: 2006-12-11
Description: Cross-site scripting (XSS) vulnerability in toplist.php in PhpBB Toplist 1.3.7 allows remote attackers to inject arbitrary HTML or web script via the (1) Name and (2) Information fields when adding a new site (toplistnew action).
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/2015; http://www.securityfocus.com/archive/1/453923/100/0/threaded; http://www.securityfocus.com/bid/21506
CVE: CVE-2006-6460
Published: 2006-12-11
Description: Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php, which leaks the path in an error message.  NOTE: this issue might be resultant from CVE-2006-2509.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0384.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/26573; http://archives.neohapsis.com/archives/bugtraq/2006-05/0384.html
CVE: CVE-2006-6461
Published: 2006-12-11
Description: tr1.php in Yourfreeworld Stylish Text Ads Script allows remote attackers to obtain the installation path via an invalid id parameter, which leaks the path in an error message.  NOTE: this issue might be resultant from CVE-2006-2508.
CVSS Score: 7.8 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-05/0381.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/26571; http://archives.neohapsis.com/archives/bugtraq/2006-05/0381.html
CVE: CVE-2006-6462
Published: 2006-12-11
Description: PHP remote file inclusion vulnerability in engine/oldnews.inc.php in CM68 News 12.02.06 allows remote attackers to execute arbitrary PHP code via a URL in the addpath parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://cm68.de/?cm68news_download; http://secunia.com/advisories/23326; http://www.securityfocus.com/bid/21499
CVE: CVE-2006-6463
Published: 2006-12-11
Description: Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files, and possibly other files, to the images/ directory under the web root.
CVSS Score: 6.5 (MEDIUM)
References: http://cupu.us/adv/15-iFX-2006-adv-midicart-phpbackdoor.txt; http://secunia.com/advisories/23296; http://securityreason.com/securityalert/2016
CVE: CVE-2006-6464
Published: 2006-12-11
Description: viewcart in Midicart accepts negative numbers in the Qty (quantity) field, which allows remote attackers to obtain a smaller total price for a shopping cart.
CVSS Score: 5.0 (MEDIUM)
References: http://cupu.us/adv/15-iFX-2006-adv-midicart-phpbackdoor.txt; http://secunia.com/advisories/23296; http://securityreason.com/securityalert/2016
CVE: CVE-2006-6465
Published: 2006-12-11
Description: Directory traversal vulnerability in WBmap.php in WikyBlog 1.3.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter.  NOTE: CVE disputes this vulnerability because l is validated by ctype_alpha before use
CVSS Score: 6.5 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/4823; https://exchange.xforce.ibmcloud.com/vulnerabilities/30650; https://www.exploit-db.com/exploits/2875
CVE: CVE-2006-6466
Published: 2006-12-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in WBmap.php in WikyBlog 1.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) key, (2) d, (3) l, or (4) v parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: CVE disputes the l vector because l is validated by ctype_alpha before use.
CVSS Score: 6.8 (MEDIUM)
References: http://www.vupen.com/english/advisories/2006/4823; http://www.vupen.com/english/advisories/2006/4823
CVE: CVE-2006-6467
Published: 2006-12-11
Description: Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not properly restrict access to SMB file resources, which allows remote attackers to gain unspecified file or directory access via vectors related to (1) visibility of the SMB "Homes" share and (2) SMB file system browsing.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6468
Published: 2006-12-11
Description: Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not check the Fully Qualified Domain Name (FQDN) during a "Validate Repository SSL Certificate" scan, which has unknown impact and attack vectors, possibly related to spoofed certificates.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6469
Published: 2006-12-11
Description: Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 do not block the postgres port (5432/tcp), which has unknown impact and remote attack vectors, probably related to unauthorized connections to a PostgreSQL daemon.
CVSS Score: 5.8 (MEDIUM)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6470
Published: 2006-12-11
Description: The SNMP Agent in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 returns no error for a non-writable object, which has unknown impact and attack vectors.  NOTE: due to the vagueness of the advisory, it is not clear whether this is a vulnerability, or a bug in a security feature.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6471
Published: 2006-12-11
Description: Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 use weak permissions for certain files, which allows unspecified file access.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6472
Published: 2006-12-11
Description: The httpd.conf file in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 configures port 443 to be always active, which has unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-6473
Published: 2006-12-11
Description: Multiple unspecified vulnerabilities in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000, 13.x before 13.050.03.000, and 14.x before 14.050.03.000 have unknown impact and attack vectors, related to (1) an Immediate Image Overwrite (IIO) error message at the Local User Interface (LUI) if overwrite fails, (2) an IIO failure when a Held Job is deleted, and (3) an On Demand Image Overwrite failure when the overwrite is greater than 2 Gb.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23265; http://www.xerox.com/downloads/usa/en/c/cert_XRX06_004_v11.pdf; http://secunia.com/advisories/23265
CVE: CVE-2006-5871
Published: 2006-12-11
Description: smbfs in Linux kernel 2.6.8 and other versions, and 2.4.x before 2.4.34, when UNIX extensions are enabled, ignores certain mount options, which could cause clients to use server-specified uid, gid and mode settings.
CVSS Score: 4.1 (MEDIUM)
References: http://secunia.com/advisories/23361; http://secunia.com/advisories/23370; http://secunia.com/advisories/23395
CVE: CVE-2006-5873
Published: 2006-12-12
Description: Buffer overflow in the cluster_process_heartbeat function in cluster.c in layer 2 tunneling protocol network server (l2tpns) before 2.1.21 allows remote attackers to cause a denial of service via a large heartbeat packet.
CVSS Score: 7.8 (HIGH)
References: http://l2tpns.cvs.sourceforge.net/l2tpns/l2tpns/cluster.c?r1=1.53&r2=1.54; http://secunia.com/advisories/23230; http://secunia.com/advisories/23333
CVE: CVE-2006-6478
Published: 2006-12-12
Description: Multiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) email.php, the (2) no parameter in (b) voirannonce.php, the (3) idmembre parameter in (c) admin/admin_membre/fiche_membre.php, and the (4) idannonce parameter in (d) admin/admin_annonce/okvalannonce.php and (e) admin/admin_annonce/changeannonce.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/23318; http://securityreason.com/securityalert/2019; http://www.securityfocus.com/archive/1/453966/100/0/threaded
CVE: CVE-2006-6479
Published: 2006-12-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the email parameter in (1) erreurinscription.php, (2) Templates/admin.dwt.php, (3) Templates/commun.dwt.php, (4) membre.dwt.php, and (5) admin/admin_config/Aide.php.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23318; http://securityreason.com/securityalert/2019; http://www.securityfocus.com/archive/1/453966/100/0/threaded
CVE: CVE-2006-6480
Published: 2006-12-12
Description: admin/admin_membre/fiche_membre.php in AnnonceScriptHP 2.0 allows remote attackers to obtain sensitive information via the idmembre parameter, which discloses the passwords for arbitrary users.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23318; http://securityreason.com/securityalert/2019; http://www.securityfocus.com/archive/1/453966/100/0/threaded
CVE: CVE-2006-6481
Published: 2006-12-12
Description: Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.
CVSS Score: 5.0 (MEDIUM)
References: http://docs.info.apple.com/article.html?artnum=307562; http://kolab.org/security/kolab-vendor-notice-14.txt; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2006-6423
Published: 2006-12-12
Description: Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command followed by a crafted parameter and a long string, as addressed by the ME-10025 hotfix.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23201; http://secunia.com/secunia_research/2006-73/advisory/; http://securityreason.com/securityalert/2022
CVE: CVE-2006-5577
Published: 2006-12-12
Description: Microsoft Internet Explorer 6 and earlier allows remote attackers to obtain sensitive information via unspecified uses of the OBJECT HTML tag, which discloses the absolute path of the corresponding TIF folder, aka "TIF Folder Information Disclosure Vulnerability," and a different issue than CVE-2006-5578.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/23288; http://securitytracker.com/id?1017374; http://www.osvdb.org/30816
CVE: CVE-2006-5578
Published: 2006-12-12
Description: Microsoft Internet Explorer 6 and earlier allows remote attackers to read Temporary Internet Files (TIF) and obtain sensitive information via unspecified vectors involving certain drag and drop operations, aka "TIF Folder Information Disclosure Vulnerability," and a different issue than CVE-2006-5577.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/23288; http://securitytracker.com/id?1017374; http://www.kb.cert.org/vuls/id/694344
CVE: CVE-2006-5579
Published: 2006-12-12
Description: Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using JavaScript to cause certain errors simultaneously, which results in the access of previously freed memory, aka "Script Error Handling Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/20807; http://secunia.com/secunia_research/2006-58/advisory/; http://securitytracker.com/id?1017373
CVE: CVE-2006-5581
Published: 2006-12-12
Description: Unspecified vulnerability in Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code via certain DHTML script functions, such as normalize, and "incorrectly created elements" that trigger memory corruption, aka "DHTML Script Function Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/23288; http://securitytracker.com/id?1017373; http://www.kb.cert.org/vuls/id/347448
CVE: CVE-2006-5583
Published: 2006-12-12
Description: Buffer overflow in the SNMP Service in Microsoft Windows 2000 SP4, XP SP2, Server 2003, Server 2003 SP1, and possibly other versions allows remote attackers to execute arbitrary code via a crafted SNMP packet, aka "SNMP Memory Corruption Vulnerability."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23307; http://securitytracker.com/id?1017371; http://www.kb.cert.org/vuls/id/901584
CVE: CVE-2006-6335
Published: 2006-12-12
Description: Multiple buffer overflows in Sophos Anti-Virus scanning engine before 2.40 allow remote attackers to execute arbitrary code via (1) a SIT archive with a long filename that is not null-terminated, which triggers a heap-based overflow in veex.dll due to improper length calculation, and (2) a CPIO archive, with a long filename that is not null-terminated, which triggers a stack-based overflow in veex.dll.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/23325; http://www.securityfocus.com/archive/1/454197/100/0/threaded; http://www.securityfocus.com/archive/1/454211/100/0/threaded
CVE: CVE-2006-6482
Published: 2006-12-12
Description: Adobe ColdFusion MX7 allows remote attackers to obtain sensitive information via a URL request (1) for a non-existent (a) JWS, (b) CFM, (c) CFML, or (d) CFC file, which displays the installation path in the resulting error message; or (2) to /CFIDE/administrator/login.cfm without a host, which can reveal the server's internal IP address in an HREF tag.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23281; http://securityreason.com/securityalert/2021; http://securitytracker.com/id?1017361
CVE: CVE-2006-6483
Published: 2006-12-12
Description: Adobe ColdFusion MX 7.x before 7.0.2 does not properly filter HTML tags when protecting against cross-site scripting (XSS) attacks, which allows remote attackers to inject arbitrary web script or HTML via a NULL byte (%00) in certain HTML tags, as demonstrated using "%00script" in a tag.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/23281; http://securityreason.com/securityalert/2021; http://securitytracker.com/id?1017361
CVE: CVE-2006-6484
Published: 2006-12-12
Description: The IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.34, Professional Edition 1.6 through 1.83, and Enterprise Edition 1.1 through 1.40 allows remote attackers to cause a denial of service (crash) via unspecified vectors that trigger a null pointer dereference, as addressed by the ME-10023 hotfix, and a different issue than CVE-2006-6423.  NOTE: some details were obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/23267; http://www.mailenable.com/hotfix/; http://www.securityfocus.com/bid/21493
CVE: CVE-2006-6485
Published: 2006-12-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in ShopSite 8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the prevlocation parameter in shopper/sc/registration.cgi and other unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/23274; http://securityreason.com/securityalert/2020; http://securitytracker.com/id?1017367