deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4662
Published: 2006-09-09
Description: Heap-based buffer overflow in the MCRegEx__Search function in AOL ICQ Pro 2003b Build 3916 and earlier allows remote attackers to execute arbitrary code via an inconsistent length field of a Message in a 0x2711 Type-Length-Value (TLV) type.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21834; http://securityreason.com/securityalert/1530; http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1509
CVE: CVE-2006-4663
Published: 2006-09-09
Description: The source code tar archive of the Linux kernel 2.6.16, 2.6.17.11, and possibly other versions specifies weak permissions (0666 and 0777) for certain files and directories, which might allow local users to insert Trojan horse source code that would be used during the next kernel compilation.  NOTE: another researcher disputes the vulnerability, stating that he finds "Not a single world-writable file or directory." CVE analysis as of 20060908 indicates that permissions will only be weak under certain unusual or insecure scenarios
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/archive/1/445539/100/0/threaded; http://www.securityfocus.com/archive/1/445540/100/0/threaded; http://www.securityfocus.com/archive/1/445539/100/0/threaded
CVE: CVE-2006-4664
Published: 2006-09-09
Description: PHP remote file inclusion vulnerability in includes/functions_portal.php in Premod Shadow 2.7.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://rst-crew.net/premodshadow.txt; http://secunia.com/advisories/21803; http://securityreason.com/securityalert/1535
CVE: CVE-2006-4665
Published: 2006-09-09
Description: Cross-site scripting (XSS) vulnerability in index.php in MKPortal M1.1 Rc1 allows remote attackers to inject arbitrary web script or HTML via the ind parameter, possibly related to the PHP_SELF variable.  NOTE: Some details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21821; http://securityreason.com/securityalert/1534; http://www.securityfocus.com/archive/1/445511/100/0/threaded
CVE: CVE-2006-4666
Published: 2006-09-09
Description: Multiple PHP remote file inclusion vulnerabilities in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via a URL in the (1) ide parameter in (a) article.php; or the (2) pwfile parameter in (b) delete.php, (c) modify.php, (d) admin.php, or (e) modify_go.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/21826; http://securityreason.com/securityalert/1533; http://securitytracker.com/id?1016813
CVE: CVE-2006-4667
Published: 2006-09-09
Description: Multiple SQL injection vulnerabilities in RunCMS 1.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in (a) class/sessions.class.php, and the (2) timezone_offset and (3) umode parameters in (b) class/xoopsuser.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21814; http://securityreason.com/securityalert/1532; http://www.hackers.ir/advisories/runcms.html
CVE: CVE-2006-4668
Published: 2006-09-09
Description: Cross-site scripting (XSS) vulnerability in index.php in Rob Hensley AckerTodo 4.0 allows remote attackers to inject arbitrary web script or HTML via the task_id parameter in an edit_task command.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21810; http://securityreason.com/securityalert/1531; http://www.osvdb.org/28611
CVE: CVE-2006-4669
Published: 2006-09-09
Description: PHP remote file inclusion vulnerability in admin/system/include.php in Somery 0.4.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the skindir parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21825; http://www.securityfocus.com/bid/19912; http://www.vupen.com/english/advisories/2006/3516
CVE: CVE-2006-4670
Published: 2006-09-09
Description: Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the dir_path parameter in (1) includes/cart.inc.php or (2) extras/ext_cats.php.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2006-09/0119.html; http://secunia.com/advisories/21796; http://www.osvdb.org/28601
CVE: CVE-2006-4671
Published: 2006-09-11
Description: PHP remote file inclusion vulnerability in headlines.php in Fantastic News 2.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[script_path] parameter, a different vector than CVE-2006-1154.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/21807; http://secunia.com/advisories/23519; http://www.securityfocus.com/bid/21796
CVE: CVE-2006-4672
Published: 2006-09-11
Description: PHP remote file inclusion vulnerability in profitCode ppalCart 2.5 EE, possibly a component of PayProCart, allows remote attackers to execute arbitrary PHP code via a URL in the (1) proMod parameter to (a) index.php, or the (2) docroot parameter to (b) index.php or (c) mainpage.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/21868; http://www.securityfocus.com/archive/1/445748/100/0/threaded; http://www.securityfocus.com/archive/1/446076/100/0/threaded
CVE: CVE-2006-4673
Published: 2006-09-11
Description: Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the _SERVER[REMOTE_ADDR] parameter to news.php.
CVSS Score: 2.6 (LOW)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9458&w=2; http://retrogod.altervista.org/phpfusion_6-01-4_xpl.html; http://secunia.com/advisories/21830
CVE: CVE-2006-4623
Published: 2006-09-11
Description: The Unidirectional Lightweight Encapsulation (ULE) decapsulation component in dvb-core/dvb_net.c in the dvb driver in the Linux kernel 2.6.17.8 allows remote attackers to cause a denial of service (crash) via an SNDU length of 0 in a ULE packet.
CVSS Score: 7.8 (HIGH)
References: http://lkml.org/lkml/2006/8/20/278; http://secunia.com/advisories/21820; http://secunia.com/advisories/22292
CVE: CVE-2006-4674
Published: 2006-09-11
Description: Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php.
CVSS Score: 7.5 (HIGH)
References: http://bugs.splitbrain.org/index.php?do=details&id=906; http://retrogod.altervista.org/dokuwiki_2006-03-09b_cmd.html; http://secunia.com/advisories/21819
CVE: CVE-2006-4675
Published: 2006-09-11
Description: Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before 2006-03-09c allows remote attackers to upload executable files into the data/media folder via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://retrogod.altervista.org/dokuwiki_2006-03-09b_cmd.html; http://secunia.com/advisories/21819; http://secunia.com/advisories/21936
CVE: CVE-2006-4676
Published: 2006-09-11
Description: TIBCO RendezVous 7.4.11 and earlier logs base64-encoded usernames and passwords in rvrd.db, which allows local users to obtain sensitive information by decoding the log file.
CVSS Score: 1.2 (LOW)
References: http://secunia.com/advisories/21748; http://www.securityfocus.com/bid/19883; http://www.vupen.com/english/advisories/2006/3497
CVE: CVE-2006-4677
Published: 2006-09-11
Description: PHP remote file inclusion vulnerability in contrib/yabbse/poc.php in phpopenchat before 3.0.2 allows remote attackers to execute arbitrary PHP code via the sourcedir parameter.  NOTE: this issue was disputed by a third-party researcher who stated that the _REQUEST parameters were dynamically unset at the beginning of the file.  Another researcher noted, and CVE agrees, that the unset PHP function can be bypassed (CVE-2006-3017).  If this issue is due to a vulnerability in PHP, then it should be excluded from CVE
CVSS Score: 7.5 (HIGH)
References: http://phpopenchat.org/index.php; http://www.securityfocus.com/archive/1/445384/100/0/threaded; http://www.securityfocus.com/archive/1/445522/100/0/threaded
CVE: CVE-2006-4678
Published: 2006-09-11
Description: PHP remote file inclusion vulnerability in News Evolution 3.0.3 allows remote attackers to execute arbitrary PHP code via the _NE[AbsPath] parameter in (1) install.php and (2) migrateNE2toNE3.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1536; http://www.securityfocus.com/archive/1/445576/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/28803
CVE: CVE-2006-4679
Published: 2006-09-11
Description: DokuWiki before 2006-03-09c enables the debug feature by default, which allows remote attackers to obtain sensitive information by calling doku.php with the X-DOKUWIKI-DO HTTP header set to "debug".
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/dokuwiki_2006-03-09b_cmd.html; http://secunia.com/advisories/21936; http://security.gentoo.org/glsa/glsa-200609-10.xml
CVE: CVE-2006-4680
Published: 2006-09-11
Description: The Remote UI in Canon imageRUNNER includes usernames and passwords when exporting an address book, which allows context-dependent attackers to obtain sensitive information.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/21788; http://securityreason.com/securityalert/1538; http://www.securityfocus.com/archive/1/445302/100/0/threaded
CVE: CVE-2006-4681
Published: 2006-09-11
Description: Directory traversal vulnerability in Redirect.bat in IBM Director before 5.10 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the file parameter.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers_pdf/dir5.10_docs_relnotes.pdf; http://secunia.com/advisories/21802; http://securitytracker.com/id?1016815
CVE: CVE-2006-4682
Published: 2006-09-11
Description: Multiple unspecified vulnerabilities in IBM Director before 5.10 allow remote attackers to cause a denial of service (crash) via unspecified vectors involving (1) malformed WMI CIM server requests and (2) malformed packets.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers_pdf/dir5.10_docs_relnotes.pdf; http://secunia.com/advisories/21802; http://www.securityfocus.com/bid/19915
CVE: CVE-2006-4683
Published: 2006-09-11
Description: IBM Director before 5.10 allows remote attackers to obtain sensitive information from HTTP headers via HTTP TRACE.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers_pdf/dir5.10_docs_relnotes.pdf; http://secunia.com/advisories/21802; http://www.securityfocus.com/bid/19915
CVE: CVE-2006-4341
Published: 2006-09-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-4340.  Reason: This candidate was withdrawn by its CNA.  It is a reservation duplicate of CVE-2006-4340.  Notes: All CVE users should reference CVE-2006-4340 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidenta
CVE: CVE-2006-2658
Published: 2006-09-12
Description: Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an HTTP request.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.suse.com/archive/suse-security-announce/2006-Sep/0005.html; http://secunia.com/advisories/21840; http://secunia.com/advisories/21847
CVE: CVE-2006-4625
Published: 2006-09-12
Description: PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
CVSS Score: 3.6 (LOW)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137; http://lists.suse.com/archive/suse-security-announce/2006-Oct/0002.html
CVE: CVE-2006-4705
Published: 2006-09-12
Description: SQL injection vulnerability in login.php in dwayner79 and Dominic Gamble Timesheet (aka Timesheet.php) 1.2.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://secaware.blogspot.com/2006/09/timesheet-121-blind-sql-injection.html; http://secunia.com/advisories/21831; http://securityreason.com/securityalert/1542
CVE: CVE-2006-4706
Published: 2006-09-12
Description: Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded space, as demonstrated using "java& #115;cript," a different vulnerability than CVE-2006-3761.
CVSS Score: 6.8 (MEDIUM)
References: http://myimei.com/security/2006-08-15/mybb-117-htmlspeacialchar_uni-fixjavascript-functions_postphp-urlxss-attack.html; http://secunia.com/advisories/21697; http://securityreason.com/securityalert/1541
CVE: CVE-2006-4707
Published: 2006-09-12
Description: Cross-site scripting (XSS) vulnerability in admin/global.php (aka the Admin CP login form) in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the query string ($_SERVER[PHP_SELF]).
CVSS Score: 6.8 (MEDIUM)
References: http://myimei.com/security/2006-08-17/mybb-117-adminglobalphp-xss-attack.html; http://secunia.com/advisories/21697; http://securityreason.com/securityalert/1540
CVE: CVE-2006-4708
Published: 2006-09-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1b allow remote attackers to inject arbitrary web script or HTML via the (1) act parameter in (a) help.php and (b) search.php, and the (2) p parameter in report.php.
CVSS Score: 6.8 (MEDIUM)
References: http://securityreason.com/securityalert/1539; http://www.securityfocus.com/archive/1/445719/100/0/threaded; http://www.securityfocus.com/bid/19916
CVE: CVE-2006-4709
Published: 2006-09-12
Description: SQL injection vulnerability in topic.php in Vikingboard 0.1b allows remote attackers to execute arbitrary SQL commands via the s parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/1539; http://www.securityfocus.com/archive/1/445719/100/0/threaded; http://www.securityfocus.com/bid/19919
CVE: CVE-2006-4710
Published: 2006-09-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in NewsGator FeedDemon before 2.0.0.25 allow remote attackers to inject arbitrary web script or HTML via an Atom 1.0 feed, as demonstrated by certain test cases of the James M. Snell Atom 1.0 feed reader test suite.
CVSS Score: 4.3 (MEDIUM)
References: http://nick.typepad.com/blog/2006/08/ann_feeddemon_2.html; http://nick.typepad.com/blog/2006/08/feed_security_a_1.html; http://secunia.com/advisories/21995
CVE: CVE-2006-4711
Published: 2006-09-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sage allow remote attackers to inject arbitrary web script or HTML via an Atom 1.0 feed, as demonstrated by certain test cases of the James M. Snell Atom 1.0 feed reader test suite.
CVSS Score: 4.3 (MEDIUM)
References: http://mozdev.org/bugs/show_bug.cgi?id=15101; http://www.snellspace.com/wp/?p=410; http://www.snellspace.com/wp/?p=448
CVE: CVE-2006-4712
Published: 2006-09-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read arbitrary local files, aka "Cross Context Scripting."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/sage-inputvalidation.xml; http://secunia.com/advisories/21839; http://securityreason.com/securityalert/1558
CVE: CVE-2006-4713
Published: 2006-09-12
Description: PHP remote file inclusion vulnerability in config.php in PSYWERKS PUMA 1.0 RC2 allows remote attackers to execute arbitrary PHP code via a URL in the fpath parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1557; http://www.bb-pcsecurity.de/Websecurity/415/org/PUMA_1.0_RC_2_%28config.php%29_R%20FI.htm; http://www.securityfocus.com/archive/1/445723/100/0/threaded
CVE: CVE-2006-4714
Published: 2006-09-12
Description: PHP remote file inclusion vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the classified_path parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21855; http://securitydot.net/xpl/exploits/vulnerabilities/articles/1467/exploit.html; http://www.securityfocus.com/bid/84147
CVE: CVE-2006-4715
Published: 2006-09-12
Description: SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21855; http://securitydot.net/xpl/exploits/vulnerabilities/articles/1464/exploit.html; http://www.securityfocus.com/bid/19934
CVE: CVE-2006-4716
Published: 2006-09-12
Description: PHP remote file inclusion vulnerability in demarrage.php in Fire Soft Board (FSB) RC3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the racine parameter.
CVSS Score: 7.5 (HIGH)
References: http://securitydot.net/xpl/exploits/vulnerabilities/articles/1446/exploit.html; http://www.securityfocus.com/bid/19899; https://exchange.xforce.ibmcloud.com/vulnerabilities/28804
CVE: CVE-2006-4717
Published: 2006-09-12
Description: The login redirection mechanism in the Drupal 4.7 Pubcookie module before 1.2.2.4 2006/09/06 and the Drupal 4.6 Pubcookie module before 1.6.2.1 2006/09/07 allows remote attackers to bypass authentication requirements and spoof identities of arbitrary users via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/83064; http://secunia.com/advisories/21811; http://www.osvdb.org/28623
CVE: CVE-2006-4718
Published: 2006-09-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in livre_or.php in KorviBlog 1.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) prenom, (2) emailFrom, or (3) body parameters.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]0932&w=2; http://secunia.com/advisories/21853; http://www.securityfocus.com/bid/19943
CVE: CVE-2006-4719
Published: 2006-09-12
Description: Multiple PHP remote file inclusion vulnerabilities in MyABraCaDaWeb 1.0.3, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the base parameter to (1) index.php or (2) pop.php.
CVSS Score: 5.1 (MEDIUM)
References: http://attrition.org/pipermail/vim/2006-September/001027.html; http://secunia.com/advisories/21817; http://www.securityfocus.com/bid/19944
CVE: CVE-2006-4720
Published: 2006-09-12
Description: PHP remote file inclusion vulnerability in random2.php in mcGalleryPRO 2006 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_folder parameter.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21850; http://securityreason.com/securityalert/1556; http://www.nyubicrew.org/adv/solpot-adv-06.txt
CVE: CVE-2006-4721
Published: 2006-09-12
Description: Directory traversal vulnerability in admin.php in CCleague Pro Sports CMS 1.0.1 RC1 allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence and trailing null (%00) byte in the language Cookie parameter, as demonstrated by executing PHP code via a log file.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21843; http://sn4k3.persiangig.com/Expl0it/CCleaguePro_V1.0.1RC1%20Directory%20Traversal%20Vulnerability.txt; http://unkn0wn.awardspace.com/Blog/?p=46
CVE: CVE-2006-4722
Published: 2006-09-12
Description: PHP remote file inclusion vulnerability in Open Bulletin Board (OpenBB) 1.0.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) index.php and possibly (2) collector.php.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1552; http://www.securityfocus.com/archive/1/445743/100/0/threaded; http://www.securityfocus.com/bid/19937
CVE: CVE-2006-4723
Published: 2006-09-12
Description: PHP remote file inclusion vulnerability in raidenhttpd-admin/slice/check.php in RaidenHTTPD 1.1.49, when register_globals and WebAdmin is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SoftParserFileXml parameter.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21833; http://www.securityfocus.com/bid/19918; http://www.vupen.com/english/advisories/2006/3542
CVE: CVE-2006-4180
Published: 2006-09-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate is a reservation duplicate of another identifier and was never published.  Notes: none
CVE: CVE-2006-0001
Published: 2006-09-12
Description: Stack-based buffer overflow in Microsoft Publisher 2000 through 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted PUB file, which causes an overflow when parsing fonts.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/21863; http://securityreason.com/securityalert/1548; http://securitytracker.com/id?1016825
CVE: CVE-2006-0032
Published: 2006-09-12
Description: Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/21861; http://securitytracker.com/id?1016826; http://www.geocities.jp/ptrs_sec/advisory09e.html
CVE: CVE-2006-3311
Published: 2006-09-12
Description: Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.
CVSS Score: 5.1 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html; http://secunia.com/advisories/21865; http://secunia.com/advisories/21901
CVE: CVE-2006-3442
Published: 2006-09-12
Description: Unspecified vulnerability in Pragmatic General Multicast (PGM) in Microsoft Windows XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted multicast message.
CVSS Score: 7.6 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/21851; http://securitytracker.com/id?1016827; http://www.kb.cert.org/vuls/id/455516
CVE: CVE-2006-3873
Published: 2006-09-12
Description: Heap-based buffer overflow in URLMON.DLL in Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1, with versions the MS06-042 patch before 20060912, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long URL in a GZIP-encoded website that was the target of an HTTP redirect, due to an incomplete fix for CVE-2006-3869.
CVSS Score: 7.5 (HIGH)
References: http://research.eeye.com/html/advisories/published/AD20060912.html; http://securityreason.com/securityalert/1555; http://securitytracker.com/id?1016839