deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-4289
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in EDCstore.pl in eDatCat 0.3 allows remote attackers to inject arbitrary web script or HTML via the user_action parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/edatcat-xss-vuln.html; http://www.securityfocus.com/bid/15889; http://pridels0.blogspot.com/2005/12/edatcat-xss-vuln.html
CVE: CVE-2005-4290
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in index.cgi in ECW-Cart 2.03 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) kword, (2) max, (3) min, (4) comp, and (5) f parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/ecw-cart-xss-vuln.html; http://secunia.com/advisories/18025; http://www.osvdb.org/21715
CVE: CVE-2005-4291
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in cart.cgi in ECTOOLS Onlineshop 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) product, (2) category, and (3) uid parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/ectools-onlineshop-xss.html; http://secunia.com/advisories/18028; http://www.osvdb.org/21731
CVE: CVE-2005-4292
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in CommerceSQL 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search module parameters, possibly the keywords parameter in the Quick Find feature.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/commercesql-xss-vuln.html; http://secunia.com/advisories/17932; http://www.osvdb.org/21717
CVE: CVE-2005-4293
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in cp-app.cgi in ClickCartPro (CCP) 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the affl parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/clickcartpro-ccp-xss-vuln.html; http://secunia.com/advisories/17927; http://www.attrition.org/pipermail/vim/2006-January/000510.html
CVE: CVE-2005-4294
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0640.html; http://secunia.com/advisories/18046; http://securitytracker.com/id?1015365
CVE: CVE-2005-4295
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in Absolute Image Gallery XE 2.x allows remote attackers to inject arbitrary web script or HTML via the text parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18065; http://www.securityfocus.com/bid/18712; http://www.vupen.com/english/advisories/2005/2922
CVE: CVE-2005-4296
Published: 2005-12-16
Description: AppServ Open Project 2.5.3 allows remote attackers to cause a denial of service via a large HTTP request.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/15851; http://www.securityfocus.com/bid/15851
CVE: CVE-2005-3652
Published: 2005-12-16
Description: Heap-based buffer overflow in Citrix Program Neighborhood client 9.0 and earlier allows remote attackers to execute arbitrary code via a long name value in an Application Set response.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18068; http://securityreason.com/securityalert/266; http://securitytracker.com/id?1015373
CVE: CVE-2005-4297
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in bbBoard 2.56 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly via the "keys" parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/bbboard-v2-xss-vuln.html; http://secunia.com/advisories/18091; http://www.securityfocus.com/bid/15884
CVE: CVE-2005-4298
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in atl.cgi in AtlantForum 4.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) sch_allsubct, (2) before, and (3) ct parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/atlantforum-xss-vuln.html; http://secunia.com/advisories/18096; http://www.securityfocus.com/bid/15887
CVE: CVE-2005-4299
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in atl.cgi in Atlant Pro 4.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) before and (2) ct parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/atlant-pro-xss-vuln.html; http://secunia.com/advisories/18095; http://www.securityfocus.com/bid/15886
CVE: CVE-2005-4300
Published: 2005-12-16
Description: Format string vulnerability in the lire_pop function in pop.c in libremail 1.1.0 and earlier, with compiled with the debug option, allows remote attackers to execute arbitrary code via a crafted e-mail or POP server response.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/archive/1/419639/100/0/threaded; http://www.securityfocus.com/bid/15906; http://www.securityfocus.com/archive/1/419639/100/0/threaded
CVE: CVE-2005-4301
Published: 2005-12-16
Description: Cross-site scripting (XSS) vulnerability in phpXplorer 0.9.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the address bar field.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/phpxplorer-xss-vuln.html; http://secunia.com/advisories/18080; http://www.osvdb.org/21744
CVE: CVE-2005-4302
Published: 2005-12-17
Description: Directory traversal vulnerability in index.php in ezDatabase 2.1.2 and earlier allows remote attackers to include arbitrary local files via ".."  sequences in the p parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/ezdatabase-vuln.html; http://secunia.com/advisories/18043; http://www.osvdb.org/21796
CVE: CVE-2005-4303
Published: 2005-12-17
Description: SQL injection vulnerability in index.php for ezDatabase 2.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the db_id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/ezdatabase-vuln.html; http://www.osvdb.org/21797; http://www.securityfocus.com/bid/15908
CVE: CVE-2005-4304
Published: 2005-12-17
Description: index.php in ezDatabase 2.1.2 and earlier allows remote attackers to obtain sensitive information via an invalid cat_id parameter, which leaks the full pathname in an error message.  NOTE: these details are uncertain because the original report has terminology problems and lack of relevant details.  The description is based partially on feedback comments.
CVSS Score: 5.0 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/ezdatabase-vuln.html; http://secunia.com/advisories/18043; http://www.osvdb.org/21798
CVE: CVE-2005-4305
Published: 2005-12-17
Description: Cross-site scripting (XSS) vulnerability in Edgewall Trac 0.9, 0.9.1, and 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly sanitized before it is returned in an error page.
CVSS Score: 4.3 (MEDIUM)
References: http://projects.edgewall.com/trac/wiki/ChangeLog; http://secunia.com/advisories/18048; http://secunia.com/advisories/18625
CVE: CVE-2005-4306
Published: 2005-12-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in SiteNet BBS 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) pg, (2) tid, (3) cid, and (4) fid parameters to netboardr.cgi, or (5) cid parameter to search.cgi.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/sitenet-bbs-xss-vuln.html; http://secunia.com/advisories/18090; http://www.securityfocus.com/bid/15883
CVE: CVE-2005-4307
Published: 2005-12-17
Description: Cross-site scripting (XSS) vulnerability in ScareCrow 2.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the forum parameter to (1) forum.cgi and (2) post.cgi, or (3) the user parameter to profile.cgi.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/scarecrow-message-board-xss-vuln.html; http://secunia.com/advisories/18084; http://www.osvdb.org/21777
CVE: CVE-2005-4308
Published: 2005-12-17
Description: index.php in ezUpload Pro 2.2 and earlier allows remote attackers to include files via the mode parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/ezupload-pro-vuln.html; http://www.osvdb.org/21911; http://www.securityfocus.com/bid/15918
CVE: CVE-2005-4309
Published: 2005-12-17
Description: SQL injection vulnerability in ezUpload Pro 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified search module parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/ezupload-pro-vuln.html; http://www.osvdb.org/21912; http://www.securityfocus.com/bid/15919
CVE: CVE-2005-4310
Published: 2005-12-17
Description: SSH Tectia Server 5.0.0 (A, F, and T), when allowing host-based authentication only, allows users to log in with the wrong credentials.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/18001; http://securitytracker.com/id?1015368; http://www.securityfocus.com/bid/15903
CVE: CVE-2005-4311
Published: 2005-12-17
Description: Cross-site scripting (XSS) vulnerability in DCForum 6.25 and earlier, and possibly DCForum+ 1.x, allows remote attackers to inject arbitrary web script or HTML via (1) the page parameter in dcboard.php and (2) unspecified search parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/dcforum-xss-vuln.html; http://secunia.com/advisories/18093; http://www.securityfocus.com/bid/15885
CVE: CVE-2005-4312
Published: 2005-12-17
Description: SQL injection vulnerability in index.php in AlmondSoft Almond Classifieds 5.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/almondsoft-products-sql-inj.html; http://secunia.com/advisories/18094; http://www.osvdb.org/21783
CVE: CVE-2005-4313
Published: 2005-12-17
Description: SQL injection vulnerability in index.php in AlmondSoft Almond Personals 4.05 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/almondsoft-products-sql-inj.html; http://secunia.com/advisories/18094; http://www.osvdb.org/21783
CVE: CVE-2005-4314
Published: 2005-12-17
Description: Cross-site scripting (XSS) vulnerability in ppcal.cgi in PPCal Shopping Cart 3.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) stop and (2) user parameters.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/ppcal-shopping-cart-xss.html; http://secunia.com/advisories/18032; http://www.securityfocus.com/bid/15892
CVE: CVE-2005-4315
Published: 2005-12-17
Description: SQL injection vulnerability in the search function in Plexum PLEXCART X3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly involving the (1) s_itemname and (2) s_orderby parameters to plexcart.pl.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://pridels0.blogspot.com/2005/12/plexcart-x3-sql-inj-vuln.html; http://secunia.com/advisories/18033; http://www.osvdb.org/21712
CVE: CVE-2005-4316
Published: 2005-12-17
Description: HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows remote attackers to cause a denial of service via a "Rose Attack" that involves sending a subset of small IP fragments that do not form a complete, larger packet.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/18082/; http://secunia.com/advisories/19086; http://securitytracker.com/id?1015361
CVE: CVE-2005-4317
Published: 2005-12-17
Description: Limbo CMS 1.0.4.2 and earlier, with register_globals off, does not protect the $_SERVER variable from external modification, which allows remote attackers to use the _SERVER[REMOTE_ADDR] parameter to (1) conduct cross-site scripting (XSS) attacks in the stats module or (2) execute arbitrary code via an eval injection attack in the wrapper option in index2.php.
CVSS Score: 6.8 (MEDIUM)
References: http://rgod.altervista.org/limbo1042_xpl.html; http://secunia.com/advisories/18063/; http://securityreason.com/securityalert/255
CVE: CVE-2005-4318
Published: 2005-12-17
Description: SQL injection vulnerability in index.php in Limbo CMS 1.0.4.2 and earlier, with register_globals off, allows remote attackers to execute arbitrary SQL commands via the _SERVER[REMOTE_ADDR] parameter, which modifies the underlying $_SERVER variable.
CVSS Score: 7.5 (HIGH)
References: http://rgod.altervista.org/limbo1042_xpl.html; http://secunia.com/advisories/18063/; http://securityreason.com/securityalert/255
CVE: CVE-2005-4319
Published: 2005-12-17
Description: Directory traversal vulnerability in index2.php in Limbo CMS 1.0.4.2 and earlier allows remote attackers to include arbitrary PHP files via ".." sequences in the option parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://rgod.altervista.org/limbo1042_xpl.html; http://secunia.com/advisories/18063/; http://securityreason.com/securityalert/255
CVE: CVE-2005-4320
Published: 2005-12-17
Description: Limbo CMS 1.0.4.2 and earlier allows remote attackers to obtain the installation path of the application via a direct request to (1) doc.inc.php, (2) element.inc.php, and (3) node.inc.php, which leaks the path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://rgod.altervista.org/limbo1042_xpl.html; http://secunia.com/advisories/18063/; http://securitytracker.com/id?1015364
CVE: CVE-2005-4321
Published: 2005-12-17
Description: The Internet Key Exchange version 1 (IKEv1) implementation in Apani Networks EpiForce 1.9 and earlier running IPSec, allow remote attackers to cause a denial of service (crash) via certain IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/17985/; http://www.kb.cert.org/vuls/id/226364; http://www.niscc.gov.uk/niscc/docs/re-20[PII_REDACTED]4.pdf?lang=en
CVE: CVE-2005-4322
Published: 2005-12-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Hitachi Cosminexus Collaboration Portal 06-00 through 06-10-/B, Groupmax Collaboration Portal 07-00 through 07-10-/B, and Groupmax Collaboration Web Client 07-00 through 07-10-/A allow remote attackers to inject arbitrary web script or HTML via the (1) Schedule and (2) Calendar components.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/17634/; http://securitytracker.com/alerts/2005/Nov/1015241.html; http://securitytracker.com/alerts/2005/Nov/1015242.html
CVE: CVE-2005-4323
Published: 2005-12-17
Description: Unspecified vulnerability in Hitachi Cosminexus Collaboration Portal 06-00 through 06-10-/B, Groupmax Collaboration Portal 07-00 through 07-10-/B, and Groupmax Collaboration Web Client 07-00 through 07-10-/A allow remote attackers to cause a denial of service of unspecified impact via repeated invalid requests to the Schedule component.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/17634/; http://securitytracker.com/alerts/2005/Nov/1015241.html; http://securitytracker.com/alerts/2005/Nov/1015242.html
CVE: CVE-2005-4324
Published: 2005-12-17
Description: Hitachi Groupmax Mail SMTP 06-50 through 06-52-/A and 07-00 through 07-20 allows remote attackers to cause a denial of service (service stop) via an e-mail message with an "invalid format."
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/17635/; http://securitytracker.com/alerts/2005/Nov/1015243.html; http://www.hitachi-support.com/security_e/vuls_e/HS05-024_e/01-e.html
CVE: CVE-2005-4325
Published: 2005-12-17
Description: Multiple unspecified vulnerabilities in Driverse before 0.56b have unknown impact and attack vectors, related to (1) a "ptrace exploit" and (2) "some other potential security problems."
CVSS Score: 10.0 (HIGH)
References: http://freshmeat.net/projects/driverse/?branch_id=61426&release_id=212356; http://securitytracker.com/alerts/2005/Nov/1015252.html; http://www.osvdb.org/20982
CVE: CVE-2005-4326
Published: 2005-12-17
Description: The web interface for American Power Conversion (APC) PowerChute Network Shutdown performs all communication in cleartext (base64-encoded), which allows remote attackers to sniff authentication credentials.
CVSS Score: 5.0 (MEDIUM)
References: http://nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=7330; http://securitytracker.com/alerts/2005/Nov/1015250.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/23183
CVE: CVE-2005-4327
Published: 2005-12-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Michael Arndt WebCal 1.11-3.04 allow remote attackers to inject arbitrary web script or HTML via the (1) function, (2) year, and (3) date parameters to webcal.cgi, (4) new calendar entries, and (5) notes for entries.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/18017; http://securityreason.com/securityalert/267; http://www.securityfocus.com/archive/1/419655/100/0/threaded
CVE: CVE-2005-4328
Published: 2005-12-17
Description: Cross-site scripting (XSS) vulnerability in webglimpse.cgi in Webglimpse 2.14.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the ID parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/webglimpse-xss-vuln.html; http://secunia.com/advisories/18076; http://www.osvdb.org/21791
CVE: CVE-2005-4329
Published: 2005-12-17
Description: SQL injection vulnerability in pafiledb.php in PHP Arena paFileDB Extreme Edition RC 5 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) newsid and (2) id parameter.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/pafiledb-extreme-edition-sql-inj.html; http://securityreason.com/securityalert/268; http://www.osvdb.org/21822
CVE: CVE-2005-4330
Published: 2005-12-17
Description: SQL injection vulnerability in browse.ihtml in iHTML Merchant Mall allows remote attackers to execute arbitrary SQL commands via the (1) id, (2) store, and (3) step parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/ihtml-merchant-mall-sql-inj.html; http://secunia.com/advisories/18073; http://www.osvdb.org/21830
CVE: CVE-2005-4331
Published: 2005-12-17
Description: SQL injection vulnerability in merchant.ihtml in iHTML Merchant Version 2 Pro allows remote attackers to execute arbitrary SQL commands via the (1) step, (2) id, and (3) pid parameters.
CVSS Score: 7.5 (HIGH)
References: http://pridels0.blogspot.com/2005/12/ihtml-merchant-version-2-pro-sql-inj.html; http://secunia.com/advisories/18089; http://www.osvdb.org/21808
CVE: CVE-2005-4332
Published: 2005-12-17
Description: Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of service or upload files via direct requests to obsolete JSP files including (1) admin/uploadclient.jsp, (2) apply_firmware_action.jsp, and (3) file.jsp.
CVSS Score: 9.4 (HIGH)
References: http://secunia.com/advisories/18103; http://securityreason.com/securityalert/265; http://securitytracker.com/id?1015375
CVE: CVE-2005-4333
Published: 2005-12-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in Binary Board System (BBS) 0.2.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) inreplyto, (2) article, and (3) board parameters to reply.pl, (4) branch, (5) board, and (6) stats.pl parameters to (b) stats.pl, and (7) board parameter to (c) toc.pl.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/binary-board-system-xss-vuln.html; http://www.osvdb.org/21893; http://www.osvdb.org/21894
CVE: CVE-2005-4334
Published: 2005-12-17
Description: SQL injection vulnerability in ZixForum 1.12 allows remote attackers to execute arbitrary SQL commands via the H_ID parameter to (1) zixforum/forum.asp, as used in (2) Headforums.asp and (3) Subject.asp.
CVSS Score: 7.5 (HIGH)
References: http://securitytracker.com/id?1015359; http://www.attrition.org/pipermail/vim/2006-April/000687.html; http://www.osvdb.org/22096
CVE: CVE-2005-4335
Published: 2005-12-17
Description: ProjectForum 4.7.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted pageid parameter to admin/versions.html.
CVSS Score: 7.8 (HIGH)
References: http://pridels0.blogspot.com/2005/12/projectforum-470-vuln.html; http://secunia.com/advisories/18071; http://www.osvdb.org/21732
CVE: CVE-2005-4336
Published: 2005-12-17
Description: Cross-site scripting (XSS) vulnerability in ProjectForum 4.7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) fwd parameter in admin/adminsignin.html and (2) originalpageid parameter in admin/newpage.html associated with a group.
CVSS Score: 4.3 (MEDIUM)
References: http://pridels0.blogspot.com/2005/12/projectforum-470-vuln.html; http://secunia.com/advisories/18071; http://www.osvdb.org/21733
CVE: CVE-2005-4337
Published: 2005-12-19
Description: The login page in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to bypass authentication and gain privileges as other users via a modified user_id parameter and a "/" in the encoded_pw parameter.
CVSS Score: 7.5 (HIGH)
References: http://www.ipomonis.com/advisories/Bb_6.zip; http://www.osvdb.org/21616; http://www.ipomonis.com/advisories/Bb_6.zip
CVE: CVE-2005-4338
Published: 2005-12-19
Description: announcement.pl in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to gain administrator privileges by setting the context parameter to "admin".
CVSS Score: 10.0 (HIGH)
References: http://www.ipomonis.com/advisories/Bb_6.zip; http://www.osvdb.org/21617; http://www.ipomonis.com/advisories/Bb_6.zip
CVE: CVE-2005-4339
Published: 2005-12-19
Description: Cross-site scripting (XSS) vulnerability in Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to inject arbitrary web script or HTML via the context parameter to announcement.pl, which is reflected in the resulting page.
CVSS Score: 4.3 (MEDIUM)
References: http://www.ipomonis.com/advisories/Bb_6.zip; http://www.ipomonis.com/advisories/Bb_6.zip
CVE: CVE-2005-4340
Published: 2005-12-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2005-4206.  Reason: This candidate is a duplicate of CVE-2005-4206.  Notes: All CVE users should reference CVE-2005-4206 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2005-4341
Published: 2005-12-19
Description: Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to list all available categories via a blank category_id parameter to category.pl.  NOTE: it is not clear whether this information is sensitive or not, so this might not be an exposure.
CVSS Score: 5.0 (MEDIUM)
References: http://www.ipomonis.com/advisories/Bb_6.zip; http://www.osvdb.org/21619; http://www.ipomonis.com/advisories/Bb_6.zip